Read the docs

Open Notebook

Records5All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9

Exploited now

Open Notebook records in CISA KEV

No Open Notebook vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Open-notebook 4 records MEDIUM

Records

5 records

TI-2026-61676 CVE-2026-90769 · GHSA-wr7p-6rrg-8m28

Open Notebook before 1.11.0 Server-Side Request Forgery via link-source

Priority HIGH 69

Open Notebook before 1.11.0 fails to validate the URL parameter in POST /api/sources endpoint, allowing authenticated users to perform server-side requests to internal services.

CVSS 4.0HIGH 8.3 Network Low privileges No interaction EPSS 0.00415 Published 2026-09-13 Fixed in 1.11.0 CWE-918
TI-2026-25969 CVE-2026-33587 · GHSA-jqjr-j3vj-vwq3

Remote Code Execution (RCE) via Server-Side Template Injection (SSTI)

Priority MEDIUM 41

Lack of user input sanitisation in Open Notebook v1.8.3 allows the application user to execute Python code (and subsequently OS commands) on the docker container via Server-Side Template Injection (SSTI) for user-created…

CVSS 4.0CRITICAL 9.2 Local No auth No interaction EPSS 0.0023 Published 2026-05-07 No fix listed CWE-20
TI-2026-22539 CVE-2026-28201 · GHSA-44mq-cghw-wf5x

SurrealDB Injection on Open Notebook

Priority LOW 39

An improper input validation, together with an overly permissive default CORS configuration in Open Notebook v1.8.1 allows remote attacker to trick a legitimate user to alter or delete arbitrary database entries via spec…

CVSS 4.0HIGH 8.7 Network No auth User interaction EPSS 0.00144 Published 2026-05-07 No fix listed CWE-20
TI-2026-25971 CVE-2026-33589 · GHSA-xfv3-v32f-xwfc

Arbitrary File Read via Local File Inclusion (LFI)

Priority LOW 35

Lack of user input validation in the file upload functionality of Open Notebook v1.8.3 allows the application user to access local files content from the docker container via path traversal.

CVSS 4.0HIGH 8.2 Local No auth No interaction EPSS 0.0018 Published 2026-05-07 No fix listed CWE-20
TI-2026-25970 CVE-2026-33588 · GHSA-c7wf-4r4p-4766

Arbitrary file write through path traversal in Open Notebook

Priority LOW 32

Lack of user input validation in the file upload functionality of Open Notebook v1.8.3 allows the application user to create or modify files on the docker container via path traversal.

CVSS 4.0HIGH 7.0 Local No auth No interaction EPSS 0.00182 Published 2026-05-07 No fix listed CWE-20
Open these records in search →