[ CVE-2026-108553 · Published 10 Oct 2026 ]
Vulnerability in OpenRefine
CVSS 7.5
EPSS <1%No fix listed yet
[ Description ]Official description
OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, executing operating system commands as the OpenRefine user.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.
[ References ]References
- github.com/OpenRefine/OpenRefine
- github.com/OpenRefine/OpenRefine/blob/bde8a36dc188f7846aeafc2910969e7d0fbc8e7c/extensio…
- github.com/OpenRefine/OpenRefine/blob/bde8a36dc188f7846aeafc2910969e7d0fbc8e7c/main/src…
- github.com/OpenRefine/OpenRefine/blob/bde8a36dc188f7846aeafc2910969e7d0fbc8e7c/modules/…
- github.com/OpenRefine/OpenRefine/issues/7999
- www.vulncheck.com/advisories/openrefine-through-3.10.1-csrf-to-rce-via-get-rows-command