open-notebook v1.8.3

v1.8.3

v1.8.3 - Security Fix

Security 3
  • Fix SurrealDB injection vulnerability via unsanitized order_by query parameter in GET /api/notebooks endpoint by adding allowlist validation for sorting parameters
  • Replace f-string query interpolation with parameterized $variable binding in source chat and migration queries to prevent injection attacks
  • Add defensive validation in the get_all() base method to prevent injection via order_by parameter
Security
  • Fix SurrealDB injection via unsanitized order_by query parameter (CVSS 8.7 High)
    • GET /api/notebooks accepted arbitrary input in the order_by parameter, allowing injection of SurrealQL commands. Exploitable via CSRF by tricking a user into clicking a crafted URL.
    • Added allowlist validation for sorting parameters in the notebooks endpoint
    • Replaced f-string query interpolation with parameterized $variable binding in source chat and migration queries
    • Added defensive validation in the get_all() base method to prevent injection via order_by parameter
Affected versions

All versions up to and including v1.8.2.

Recommended action

Upgrade to v1.8.3 immediately.

Credit

Reported by CERT-EU Offensive Security Team via coordinated vulnerability disclosure.

View original

Upgraded? How did it go?

Discussion