VulnSocial

CVE-2026-123198

LOWCVSS 9.3 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

LMFDB before commit 01829bd contains a server-side template injection vulnerability in the render_knowl function that allows unauthenticated attackers to inject Jinja expressions via request parameters. Attackers can supply crafted query-string values or 'content' data to /knowledge/render/<ID> to reach Python builtins and execute operating system commands as the web application account.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-1336

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • 36 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Peaked 1d ago at 35 mentions (2026-11-05); latest day: 1
  • 36 total mentions across 2 days

Deep dive

Activity timeline36 mentions / 2d
09182635Mentions · 2026-11-05: 35Mentions · 2026-11-06: 111-0511-06
Referenced assets6 URLs
Full discourse20 posts
  • Enclave Radar@EnclaveRadar

    🆕 New CVE: CVE-2026-123198 (CVSS 9.8, Enclave score 7/10) LMFDB before commit 01829bd Unauthenticated Server-Side Template Injection via /knowledge/render/&lt;ID&gt; Remote, no login needed. LMFDB before commit 01829bd contains a server-side template… https://app.enclave.ai/threat-feed/CVE-2026-123198

    0000142
    204 followersView on X
  • Eliran Emuna@EmunaEliran

    CVE-2026-123198: CVSS 9.8 critical advisory is out LMFDB before commit 01829bd contains a server-side template injection vulnerability in the render_knowl function that allows unauthenticated attackers to inject Jinja expressions via request parameters. https://www.cve.org/CVERecord?id=CVE-2026-123198 #CyberSecurity #InfoSec #ThreatIntel #VulnerabilityManagement #PatchManagement #BlueTeam #SOC #DetectionEngineering

    0001038
    80 followersView on X
  • AgentPrime@agentprime_io

    🔴 LMFDB: LMFDB before commit 01829bd Unauthenticated Server-Side Template Injection via /knowledge/render/&lt;ID&gt; (CVE-2026-123198) Fix → 01829bd09b692c720aad30c… https://agentprime.io/advisories/CVE-2026-123198/

    0000030
    2 followersView on X
  • Eliran Emuna@EmunaEliran

    CVE-2026-123198: CVSS 9.8 critical advisory is out LMFDB before commit 01829bd contains a server-side template injection vulnerability in the render_knowl function that allows unauthenticated attackers to inject Jinja expressions via request parameters. https://github.com/LMFDB/lmfdb/blob/c6e5bac205aa12de9edf584a06328fefa81de0de/lmfdb/knowledge/main.py#L747 #CyberSecurity #InfoSec #ThreatIntel #VulnerabilityManagement #PatchManagement #BlueTeam #SOC #DetectionEngineering

    0000038
    80 followersView on X
  • Eliran Emuna@EmunaEliran

    CVE-2026-123198: CVSS 9.8 critical advisory is out LMFDB before commit 01829bd contains a server-side template injection vulnerability in the render_knowl function that allows unauthenticated attackers to inject Jinja expressions via request parameters. https://github.com/LMFDB/lmfdb/blob/c6e5bac205aa12de9edf584a06328fefa81de0de/lmfdb/knowledge/main.py#L747 #CyberSecurity #InfoSec #ThreatIntel #VulnerabilityManagement #PatchManagement #BlueTeam #SOC #DetectionEngineering

    0000040
    80 followersView on X
  • Eliran Emuna@EmunaEliran

    CVE-2026-123198: CVSS 9.8 critical advisory is out LMFDB before commit 01829bd contains a server-side template injection vulnerability in the render_knowl function that allows unauthenticated attackers to inject Jinja expressions via request parameters. https://github.com/LMFDB/lmfdb/blob/c6e5bac205aa12de9edf584a06328fefa81de0de/lmfdb/knowledge/main.py#L747 #CyberSecurity #InfoSec #ThreatIntel #VulnerabilityManagement #PatchManagement #BlueTeam #SOC #DetectionEngineering

    0000030
    80 followersView on X
  • Eliran Emuna@EmunaEliran

    CVE-2026-123198: CVSS 9.8 critical advisory is out LMFDB before commit 01829bd contains a server-side template injection vulnerability in the render_knowl function that allows unauthenticated attackers to inject Jinja expressions via request parameters. https://github.com/LMFDB/lmfdb/blob/c6e5bac205aa12de9edf584a06328fefa81de0de/lmfdb/knowledge/main.py#L747 #CyberSecurity #InfoSec #ThreatIntel #VulnerabilityManagement #PatchManagement #BlueTeam #SOC #DetectionEngineering

    0000039
    81 followersView on X
  • Eliran Emuna@EmunaEliran

    CVE-2026-123198: CVSS 9.8 critical advisory is out LMFDB before commit 01829bd contains a server-side template injection vulnerability in the render_knowl function that allows unauthenticated attackers to inject Jinja expressions via request parameters. https://github.com/LMFDB/lmfdb/blob/c6e5bac205aa12de9edf584a06328fefa81de0de/lmfdb/knowledge/main.py#L747 #CyberSecurity #InfoSec #ThreatIntel #VulnerabilityManagement #PatchManagement #BlueTeam #SOC #DetectionEngineering

    0000045
    81 followersView on X
  • Eliran Emuna@EmunaEliran

    CVE-2026-123198: CVSS 9.8 critical advisory is out LMFDB before commit 01829bd contains a server-side template injection vulnerability in the render_knowl function that allows unauthenticated attackers to inject Jinja expressions via request parameters. https://github.com/LMFDB/lmfdb/blob/c6e5bac205aa12de9edf584a06328fefa81de0de/lmfdb/knowledge/main.py#L747 #CyberSecurity #InfoSec #ThreatIntel #VulnerabilityManagement #PatchManagement #BlueTeam #SOC #DetectionEngineering

    0000029
    80 followersView on X
  • Enclave Radar@EnclaveRadar

    💥 Public exploit released: CVE-2026-123198 (CVSS 9.8, Enclave score 7/10) LMFDB before commit 01829bd Unauthenticated Server-Side Template Injection via /knowledge/render/&lt;ID&gt; Remote, no login needed. LMFDB before commit 01829bd contains a server-side… https://app.enclave.ai/threat-feed/CVE-2026-123198

    0000043
    204 followersView on X
  • Eliran Emuna@EmunaEliran

    CVE-2026-123198: CVSS 9.8 critical advisory is out LMFDB before commit 01829bd contains a server-side template injection vulnerability in the render_knowl function that allows unauthenticated attackers to inject Jinja expressions via request parameters. https://github.com/LMFDB/lmfdb/blob/c6e5bac205aa12de9edf584a06328fefa81de0de/lmfdb/knowledge/main.py#L747 #CyberSecurity #InfoSec #ThreatIntel #VulnerabilityManagement #PatchManagement #BlueTeam #SOC #DetectionEngineering

    0000027
    80 followersView on X
  • Eliran Emuna@EmunaEliran

    CVE-2026-123198: CVSS 9.8 critical advisory is out LMFDB before commit 01829bd contains a server-side template injection vulnerability in the render_knowl function that allows unauthenticated attackers to inject Jinja expressions via request parameters. https://github.com/LMFDB/lmfdb/blob/c6e5bac205aa12de9edf584a06328fefa81de0de/lmfdb/knowledge/main.py#L747 #CyberSecurity #InfoSec #ThreatIntel #VulnerabilityManagement #PatchManagement #BlueTeam #SOC #DetectionEngineering

    0000018
    80 followersView on X
  • KKAA Solutions@kkaasolutions

    CVE-2026-123198 (CRITICAL / 9.8) — #LMFDB before commit 01829bd contains a server-side template injection vulnerability in the render_knowl function that al... https://nvd.nist.gov/vuln/detail/CVE-2026-123198 #python #cve #kkaasolutions

    0000028
    7 followersView on X
  • Eliran Emuna@EmunaEliran

    CVE-2026-123198: CVSS 9.8 critical advisory is out LMFDB before commit 01829bd contains a server-side template injection vulnerability in the render_knowl function that allows unauthenticated attackers to inject Jinja expressions via request parameters. https://github.com/LMFDB/lmfdb/blob/c6e5bac205aa12de9edf584a06328fefa81de0de/lmfdb/knowledge/main.py#L747 #CyberSecurity #InfoSec #ThreatIntel #VulnerabilityManagement #PatchManagement #BlueTeam #SOC #DetectionEngineering

    0000029
    81 followersView on X
  • Eliran Emuna@EmunaEliran

    CVE-2026-123198: CVSS 9.8 critical advisory is out LMFDB before commit 01829bd contains a server-side template injection vulnerability in the render_knowl function that allows unauthenticated attackers to inject Jinja expressions via request parameters. https://github.com/LMFDB/lmfdb/blob/c6e5bac205aa12de9edf584a06328fefa81de0de/lmfdb/knowledge/main.py#L747 #CyberSecurity #InfoSec #ThreatIntel #VulnerabilityManagement #PatchManagement #BlueTeam #SOC #DetectionEngineering

    0000025
    80 followersView on X
  • Eliran Emuna@EmunaEliran

    CVE-2026-123198: CVSS 9.8 critical advisory is out LMFDB before commit 01829bd contains a server-side template injection vulnerability in the render_knowl function that allows unauthenticated attackers to inject Jinja expressions via request parameters. https://github.com/LMFDB/lmfdb/blob/c6e5bac205aa12de9edf584a06328fefa81de0de/lmfdb/knowledge/main.py#L747 #CyberSecurity #InfoSec #ThreatIntel #VulnerabilityManagement #PatchManagement #BlueTeam #SOC #DetectionEngineering

    0000031
    81 followersView on X
  • Eliran Emuna@EmunaEliran

    CVE-2026-123198: CVSS 9.3 critical advisory is out LMFDB before commit 01829bd contains a server-side template injection vulnerability in the render_knowl function that allows unauthenticated attackers to inject Jinja expressions via request parameters. https://github.com/LMFDB/lmfdb/blob/c6e5bac205aa12de9edf584a06328fefa81de0de/lmfdb/knowledge/main.py#L747 #CyberSecurity #InfoSec #ThreatIntel #VulnerabilityManagement #PatchManagement #BlueTeam #SOC #DetectionEngineering

    0000030
    81 followersView on X
  • Eliran Emuna@EmunaEliran

    CVE-2026-123198: CVSS 9.3 critical advisory is out LMFDB before commit 01829bd contains a server-side template injection vulnerability in the render_knowl function that allows unauthenticated attackers to inject Jinja expressions via request parameters. https://github.com/LMFDB/lmfdb/blob/c6e5bac205aa12de9edf584a06328fefa81de0de/lmfdb/knowledge/main.py#L747 #CyberSecurity #InfoSec #ThreatIntel #VulnerabilityManagement #PatchManagement #BlueTeam #SOC #DetectionEngineering

    0000029
    80 followersView on X
  • Eliran Emuna@EmunaEliran

    CVE-2026-123198: CVSS 9.3 critical advisory is out LMFDB before commit 01829bd contains a server-side template injection vulnerability in the render_knowl function that allows unauthenticated attackers to inject Jinja expressions via request parameters. https://github.com/LMFDB/lmfdb/blob/c6e5bac205aa12de9edf584a06328fefa81de0de/lmfdb/knowledge/main.py#L747 #CyberSecurity #InfoSec #ThreatIntel #VulnerabilityManagement #PatchManagement #BlueTeam #SOC #DetectionEngineering

    0000026
    80 followersView on X
  • Eliran Emuna@EmunaEliran

    CVE-2026-123198: CVSS 9.3 critical advisory is out LMFDB before commit 01829bd contains a server-side template injection vulnerability in the render_knowl function that allows unauthenticated attackers to inject Jinja expressions via request parameters. https://github.com/LMFDB/lmfdb/blob/c6e5bac205aa12de9edf584a06328fefa81de0de/lmfdb/knowledge/main.py#L747 #CyberSecurity #InfoSec #ThreatIntel #VulnerabilityManagement #PatchManagement #BlueTeam #SOC #DetectionEngineering

    0000027
    80 followersView on X

Explore more

Back to dashboard