Download Latest Version v1.8.4 - Security Fix source code.tar.gz (2.2 MB)
Email in envelope

Get an email when there's a new version of Open Notebook

Home / v1.8.3
Name Modified Size InfoDownloads / Week
Parent folder
README.md 2026-04-07 843 Bytes
0
v1.8.3 - Security Fix source code.tar.gz 2026-04-07 2.2 MB
1 1 weekly downloads
v1.8.3 - Security Fix source code.zip 2026-04-07 2.5 MB
3 3 weekly downloads
Totals: 3 Items   4.7 MB 4

Security

  • Fix SurrealDB injection via unsanitized order_by query parameter (CVSS 8.7 High)
  • GET /api/notebooks accepted arbitrary input in the order_by parameter, allowing injection of SurrealQL commands. Exploitable via CSRF by tricking a user into clicking a crafted URL.
  • Added allowlist validation for sorting parameters in the notebooks endpoint
  • Replaced f-string query interpolation with parameterized $variable binding in source chat and migration queries
  • Added defensive validation in the get_all() base method to prevent injection via order_by parameter

Affected versions

All versions up to and including v1.8.2.

Recommended action

Upgrade to v1.8.3 immediately.

Credit

Reported by CERT-EU Offensive Security Team via coordinated vulnerability disclosure.

Source: README.md, updated 2026-04-07