HarborGuard / CVE
Back to search
HIGHCVE-2026-28201Published Modified CNA ENISA

CVE-2026-28201: SurrealDB Injection on Open Notebook

An improper input validation, together with an overly permissive default CORS configuration in Open Notebook v1.8.1 allows remote attacker to trick a legitimate user to alter or delete arbitrary database entries via specially crafted malicious URL. Depending on the deployment, data exfiltration is also possible.

Metrics

CVSS v4.0
8.7
Severity
HIGH
Fixed in
—
Affected Products
1
Affected packages
  • Open Notebook / Open Notebook
    ≤ 1.8.2
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References