CVE-2026-123198

The software LMFDB (versions prior to commit 01829bd ) is vulnerable to an unauthenticated Server-Side Template Injection (SSTI) in the render_knowl function. Attackers can inject Jinja expressions via request parameters, specifically by supplying crafted query-string values or content data to th...