# open-notebook v1.8.3 — v1.8.3 - Security Fix

- Product: open-notebook (https://whatsnew.fyi/product/open-notebook)
- Vendor: lfnovo
- Date: 2026-04-07
- Version: v1.8.3
- Original notes: https://github.com/lfnovo/open-notebook/releases/tag/v1.8.3
- Permalink: https://whatsnew.fyi/product/open-notebook/releases/v1.8.3

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Fix SurrealDB injection vulnerability via unsanitized order_by query parameter in GET /api/notebooks endpoint by adding allowlist validation for sorting parameters
- **security** — Replace f-string query interpolation with parameterized $variable binding in source chat and migration queries to prevent injection attacks
- **security** — Add defensive validation in the get_all() base method to prevent injection via order_by parameter

##### Security

- **Fix SurrealDB injection via unsanitized `order_by` query parameter** (CVSS 8.7 High)
  - `GET /api/notebooks` accepted arbitrary input in the `order_by` parameter, allowing injection of SurrealQL commands. Exploitable via CSRF by tricking a user into clicking a crafted URL.
  - Added allowlist validation for sorting parameters in the notebooks endpoint
  - Replaced f-string query interpolation with parameterized `$variable` binding in source chat and migration queries
  - Added defensive validation in the `get_all()` base method to prevent injection via `order_by` parameter

###### Affected versions

All versions up to and including v1.8.2.

###### Recommended action

Upgrade to v1.8.3 immediately.

###### Credit

Reported by [CERT-EU](https://cert.europa.eu) Offensive Security Team via coordinated vulnerability disclosure.