CVE-2026-33587: Critical SSTI to RCE in Open Notebook

CVE-2026-33587 is a server side template injection in Open Notebook 1.8.3 and earlier, scored 10.0 (critical) in NVD. A user can run Python code, and then operating system commands, inside the Docker container. The fix is Open Notebook 1.8.4, which moves template rendering into a sandbox.

What's affected

The GitHub advisory for the lfnovo/open-notebook project lists affected versions as 1.8.3 and below, and patched versions as 1.8.4. The NVD record names version 1.8.3 specifically.

The flaw sits in how user created transformations work. Transformation prompts are templates, and the advisory says they were rendered by an unsandboxed Jinja2 environment through the ai-prompter library. Any deployment where more than one person can create or edit transformations is in scope.

The advisory describes the attacker as an authenticated user. NVD scores it as needing no privileges, so treat any instance reachable from a network you do not fully trust as exposed.

How to check if you're exposed

Find the Open Notebook version you run. For a pip based install:

pip show open-notebook
pip show ai-prompter

Version 1.8.3 or lower of open-notebook is affected. The fix bumped ai-prompter to 0.4.0, so a lower ai-prompter version alongside an old Open Notebook release is a second sign.

For Docker deployments, look at the image tag in your compose file or run:

docker ps --format '{{.Image}}'

Compare the tag with 1.8.4. If you pin to latest or a floating tag, pull and check what the running container reports rather than assuming.

Also review who has accounts. The advisory frames this as an issue for authenticated users, so the number of people who can create transformations tells you how wide the exposure was.

What to do now

1. Upgrade Open Notebook to 1.8.4 or later and redeploy the container.
2. Confirm the dependency tree now includes ai-prompter 0.4.0 or later.
3. Limit transformation creation to people you trust until the upgrade is done. This is a precaution of ours, not an advisory workaround.
4. If an untrusted user could reach the instance on 1.8.3 or older, treat the container as possibly compromised. The advisory notes that environment variables, including the encryption key used to decrypt stored API keys, were reachable. Rotate the provider API keys stored in the app and the encryption key itself.
5. Check container logs and the filesystem for changes you did not make, since the advisory says arbitrary files could be read and written.

Why it matters

Server side template injection happens when an application treats user supplied text as a template to execute instead of as plain data. Jinja2 templates can reach Python objects, so an unsandboxed environment turns a prompt editor into a code execution surface. NVD files this record under CWE-20, improper input validation, which is the broad class that covers missing checks on user input.

The fix is a design change, not a filter. The advisory says all template rendering now uses Jinja2's SandboxedEnvironment, which limits what a template can touch. A sandbox is a better answer than trying to block bad strings, because blocklists for template syntax tend to miss variants.

A second lesson is the dependency chain. The unsafe behavior lived in ai-prompter, a library the application pulled in, and the application fix was to raise that library's version. Your inventory needs to show transitive packages like this one, not only the packages you named yourself. The record does not mark this CVE as exploited in the wild, and it is not in the CISA KEV catalog.

Try it yourself

Click through it at your own pace, or open it full screen.

You can also run the free in-browser dependency scan at gold.safeguard.sh/scan against your requirements file to see whether open-notebook or ai-prompter appear in your tree.

Quick check

Sources

• GitHub advisory GHSA-f35w-wx37-26q7 for lfnovo/open-notebook

Last reviewed: 19 October 2026.