# open-notebook v1.8.4 — v1.8.4 - Security Fix

- Product: open-notebook (https://whatsnew.fyi/product/open-notebook)
- Vendor: lfnovo
- Date: 2026-04-09
- Version: v1.8.4
- Original notes: https://github.com/lfnovo/open-notebook/releases/tag/v1.8.4
- Permalink: https://whatsnew.fyi/product/open-notebook/releases/v1.8.4

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Fixed remote code execution vulnerability via server-side template injection in user-created transformation prompts by upgrading ai-prompter to 0.4.0 which uses SandboxedEnvironment for all template rendering
- **security** — Fixed arbitrary file write vulnerability via path traversal in file upload by sanitizing filenames with os.path.basename() and validating resolved paths
- **security** — Fixed arbitrary file read vulnerability via local file inclusion in source creation endpoint by validating file paths are within the uploads directory

##### Security

Three vulnerabilities reported by CERT-EU Offensive Security Team via coordinated disclosure:

- **Remote Code Execution via Server-Side Template Injection** (CVSS 9.2 Critical)
  - User-created transformation prompts were rendered by an unsandboxed Jinja2 environment, allowing arbitrary Python code execution on the server. Bumped ai-prompter to 0.4.0 which uses `SandboxedEnvironment` for all template rendering.

- **Arbitrary file write via path traversal** (CVSS 7.0 High)
  - File upload did not sanitize filenames, allowing path traversal payloads (e.g., `../../../../tmp/test.txt`) to write files outside the upload directory. Filenames are now sanitized with `os.path.basename()` and resolved paths are validated.

- **Arbitrary file read via Local File Inclusion** (CVSS 8.2 High)
  - The source creation endpoint accepted arbitrary `file_path` values, allowing reading of any file on the container (e.g., `/etc/passwd`, `/proc/self/environ`). File paths are now validated to be within the uploads directory.

###### Affected versions

All versions up to and including v1.8.3.

###### Recommended action

Upgrade to v1.8.4 immediately.

###### Credit

Reported by [CERT-EU](https://cert.europa.eu) Offensive Security Team via coordinated vulnerability disclosure.