CVE-2026-33587 CRITICAL

CVE-2026-33587: Remote Code Execution (RCE) via Server-Side Template Injection (SSTI)

Vendor Open Notebook
Product Open Notebook
Weakness CWE-20 · Input validation
Published May 7, 2026
Last update May 7, 2026
View on NVD All CVEs

CVSS base score

9.2/10
Attack vector Local
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N

What the vulnerability does

01Description

Lack of user input sanitisation in Open Notebook v1.8.3 allows the application user to execute Python code (and subsequently OS commands) on the docker container via Server-Side Template Injection (SSTI) for user-created transformations.

Key dates

02Disclosure timeline

May 7, 2026 CVE published
May 7, 2026 Record updated