CVE-2026-28201

Katalog CVE

CVSS 7.8 · High EPSS 0,21%

Kerentanan Improper Input Validation pada lfnovo open-notebook. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

An improper input validation, together with an overly permissive default CORS configuration in Open Notebook v1.8.1 allows remote attacker to trick a legitimate user to alter or delete arbitrary database entries via specially crafted malicious URL. Depending on the deployment, data exfiltration is also possible.

Rincian

Terbit di NVD

7 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-352: Cross-Site Request Forgery (CSRF)
CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

EPSS (30 hari)

0,21% peluang dieksploitasi; lebih tinggi dari 10,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/lfnovo/open-notebook/security/advisories/GHSA-5wj9-f8q5-8f9c advisory vendor