A guy named Santosh Kumar Puppala sent me an email:

I'm a security researcher and I'd like to report a vulnerability in Lino privately for coordinated disclosure. The lino-framework/lino repository doesn't have GitHub private vulnerability reporting enabled, so I'm reaching out by email. (I see the GitHub repo is archived; I'm contacting you directly as the active maintainer.)

Summary

Lino's memo parser evaluates [=<expression>] sequences with an unrestricted Python eval() on every save and every render of a "previewable" field. The behavior is hardcoded on (safe_mode = False) with no site-configuration switch to disable it. Because a comment body is a previewable field writable by the base low-privilege comment-poster role (CommentsUser), an authenticated low-privilege user who posts a comment containing such an expression reaches the eval() sink and achieves server-side Python execution as the application process. Because the payload persists in the stored comment and re-evaluates on render, it also runs when other users view the comment.

...

I'd appreciate a CVE for this issue and public credit to Santosh Kumar Puppala (github.com/Santoshkumarpuppala). I'm following coordinated disclosure and will hold public details until a fix is released and any advisory is public.