CVE-2026-28201 - SurrealDB Injection on Open Notebook

Back Back to CVE browser

HIGH

SurrealDB Injection on Open Notebook

Published May 7, 2026

8.7

HIGH

CVSS 4.0

EPSS 0.21%

Description

An improper input validation, together with an overly permissive default CORS configuration in Open Notebook v1.8.1 allows remote attacker to trick a legitimate user to alter or delete arbitrary database entries via specially crafted malicious URL. Depending on the deployment, data exfiltration is also possible.

Affected products

Vendor Open Notebook Product Open Notebook Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <=1.8.2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Open Notebook

unaffected

Version	Status	Constraints
0	affected	<=1.8.2

Remediation

No remediation recorded yet.

Weaknesses (3)

CWE-20

Improper Input Validation

CWE-352

CSRF

CWE-917

Expression Language Injection

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-28345
Advisory
https://github.com/lfnovo/open-notebook/security/advisories/GHSA-5wj9-f8q5-8f9c
vendor-advisoryVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-28345		Advisory
https://github.com/lfnovo/open-notebook/security/advisories/GHSA-5wj9-f8q5-8f9c		vendor-advisoryVendor Advisory