Description

LMFDB before commit 01829bd contains a server-side template injection vulnerability in the render_knowl function that allows unauthenticated attackers to inject Jinja expressions via request parameters. Attackers can supply crafted query-string values or 'content' data to /knowledge/render/<ID> to reach Python builtins and execute operating system commands as the web application account.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-11-05T19:17:18.393Z",
  "pubdate": "2026-11-05T19:17:18.393Z",
  "executiveSummary": "LMFDB is susceptible to a critical Server-Side Template Injection (SSTI) vulnerability located within the render_knowl function. This flaw allows unauthenticated remote attackers to inject malicious Jinja2 expressions through specifically crafted HTTP request parameters.\nBy manipulating the query-string or 'content' data provided to the /knowledge/render/<ID> endpoint, an attacker can bypass template sandboxing mechanisms. This enables the execution of arbitrary Python code, facilitating Remote Code Execution (RCE) with the privileges of the web application service account.\nThe vulnerability poses a severe risk to the confidentiality, integrity, and availability of the underlying server. Successful exploitation grants an attacker the ability to interact with Python builtins, potentially leading to unauthorized data exfiltration, system compromise, and lateral movement within the hosting environment. This vulnerability is present in all versions of LMFDB prior to the fix committed in 01829bd.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of user-supplied input within the render_knowl function in LMFDB. The application fails to adequately sanitize or escape data before passing it to the Jinja2 template engine. Specifically, when the application processes request parameters or content data for the /knowledge/render/<ID> endpoint, it permits the evaluation of Jinja2 syntax within the server-side context.\nThe exploitation flow begins with an unauthenticated attacker crafting a malicious payload formatted as a Jinja2 template expression (e.g., using double curly braces '{{ }}'). This payload is submitted via the query-string or the 'content' parameter to the /knowledge/render/<ID> URI. Upon receipt, the application processes this input through the vulnerable render_knowl function, which inadvertently treats the input as executable template code rather than plain text.\nBecause the Jinja2 engine is invoked without a restricted environment or a secure sandboxing configuration, the attacker can traverse the Python object hierarchy. By accessing internal built-in objects (e.g., __subclasses__(), __globals__, or __init__), the attacker can escape the template context and gain access to arbitrary Python modules. This typically involves accessing the 'os' module to execute system-level commands.\nThe impact of this vulnerability is total system compromise. Once code execution is achieved, the attacker operates with the security context of the web application account. This allows for the execution of shell commands, which can be utilized to read sensitive configuration files, modify internal application logic, install persistent backdoors, or pivot into the internal network infrastructure. This vulnerability remains active in all codebase iterations prior to commit 01829bd. No special privileges are required, and the attack is fully exploitable via standard network requests, requiring only that the vulnerable endpoint is reachable by the attacker."
}