v1.8.3

probelabs/probev1.8.3Apr 7, 2026by lfnovo

AI Summary

This release addresses a critical high-severity SQL injection vulnerability in the SurrealDB backend, specifically targeting the `order_by` query parameter to prevent arbitrary code execution.

Key Highlights

Fix SurrealDB injection via unsanitized `order_by` query parameter (CVSS 8.7 High)
Added allowlist validation for sorting parameters in the notebooks endpoint
Replaced f-string query interpolation with parameterized `$variable` binding
Added defensive validation in the `get_all()` base method

Full Release Notes

## Security

- **Fix SurrealDB injection via unsanitized `order_by` query parameter** (CVSS 8.7 High)
  - `GET /api/notebooks` accepted arbitrary input in the `order_by` parameter, allowing injection of SurrealQL commands. Exploitable via CSRF by tricking a user into clicking a crafted URL.
  - Added allowlist validation for sorting parameters in the notebooks endpoint
  - Replaced f-string query interpolation with parameterized `$variable` binding in source chat and migration queries
  - Added defensive validation in the `get_all()` base method to prevent injection via `order_by` parameter

### Affected versions

All versions up to and including v1.8.2.

### Recommended action

Upgrade to v1.8.3 immediately.

### Credit

Reported by [CERT-EU](https://cert.europa.eu) Offensive Security Team via coordinated vulnerability disclosure.