CVE-2026-123198

LMFDB before commit 01829bd contains a server-side template injection vulnerability in the renderknowl function that allows unauthenticated attackers to inject Jinja expressions via request parameters. Attackers can supply crafted query-string values or 'content' data to /knowledge/render/ to rea...