CVE-2026-123198: Critical SSTI in LMFDB with RCE

CVE-2026-123198 is a server-side template injection (SSTI) in the render_knowl function of LMFDB (The L-functions and Modular forms Database), an open-source research database used for studying L-functions. The vulnerability allows unauthenticated users to inject Jinja2 code via HTTP parameters to the /knowledge/render/<ID> endpoint, reaching Python builtins and executing operating system commands with web application account privileges.

The CVSS score is 9.8 (critical). The vulnerability was made public on NVD on November 5, 2026, just 3 days ago. The fix is identified in commit 01829bd of the official repository. Social media activity (1 post, 2 interactions) signals the vulnerability; content is UNVERIFIED but public discussion is confirmed. Status requires immediate action from sysadmins and CISOs managing LMFDB instances.

For defenders: (1) Immediately check if LMFDB is present in production or on network-accessible systems. (2) If yes: apply the update to commit 01829bd or later without delay. (3) If the update cannot be immediate: monitor access logs for /knowledge/render/ to detect exploitation attempts, implement WAF rules blocking parameterized requests to that endpoint. (4) No effective mitigation exists without the patch.