CVE-2026-33587: open-notebook vulnerability

Lack of user input sanitisation in Open Notebook v1.8.3 allows the application user to execute Python code (and subsequently OS commands) on the docker container via Server-Side Template Injection (SSTI) for user-created transformations.
CVE-2026-33587CVSS 9.2Containers

CVE-2026-33587: open-notebook vulnerability

Lack of user input sanitisation in Open Notebook v1.8.3 allows the application user to execute Python code (and subsequently OS commands) on the docker container via Server-Side Template Injection (SSTI) for user-created transformations.

CVSS
9.2 CRITICAL
EPSS
13.71%
Known exploited
not in KEV
Product
open-notebook

What is known

Lack of user input sanitisation in Open Notebook v1.8.3 allows the application user to execute Python code (and subsequently OS commands) on the docker container via Server-Side Template Injection (SSTI) for user-created transformations.

Sources

Back to security hubContact DataHouse