CVE-2026-33587CWE-20

Remote Code Execution (RCE) via Server-Side Template Injection (SSTI)

Critical · published May 7, 2026

CVSS v4.0
9.2
EPSS
0%
Percentile
30.6
In the wild
Unconfirmed
What it is

Lack of user input sanitisation in Open Notebook v1.8.3 allows the application user to execute Python code (and subsequently OS commands) on the docker container via Server-Side Template Injection (SSTI) for user-created transformations.

The record
Technical detail
CVSS v4.0
9.2 · CRITICAL
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N
EPSS
0.00378 · 30.6th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2026-05-07T10:22Z
EPSS history
Timeline
  • 07 MAY 10:22Z
    Remote Code Execution (RCE) via Server-Side Template Injection (SSTI)
    cvelistv5