CVE Feed

    Dashboard / CVE / CVE-2026-108553

    CVE-2026-108553

    OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, executing operating system commands as the OpenRefine user.

    Published:Oct 10, 2026
    Last Modified:Oct 18, 2026
    EPS:Oct 10, 2026
    EPSS Score:0.00185
    CVSS Score:7.5

    Affected Products

    Vendor
    Openrefine
    Product
    Openrefine

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-352 Cross-Site Request Forgery

    Related CVEs

    CVE-2024-49760 (CVSS 7.1) — OpenRefine is a free, open source tool for working with messy data. The load-language command expects a `lang`…
    CVE-2024-47882 (CVSS 5.9) — OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the built-in "Some…
    CVE-2024-47881 (CVSS 8.1) — OpenRefine is a free, open source tool for working with messy data. Starting in version 3.4-beta and prior to …
    CVE-2024-47880 (CVSS 8.1) — OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the `export-rows` …
    CVE-2024-47879 (CVSS 7.6) — OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, lack of cross-site…
    CVE-2024-47878 (CVSS 8.1) — OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the `/extension/gd…
    CVE-2024-23833 (CVSS 7.5) — OpenRefine is a free, open source power tool for working with messy data and improving it. A jdbc attack vulne…
    CVE-2023-41887 (CVSS 9.8) — OpenRefine is a powerful free, open source tool for working with messy data. Prior to version 3.7.5, a remote …
    CVE-2023-41886 (CVSS 7.5) — OpenRefine is a powerful free, open source tool for working with messy data. Prior to version 3.7.5, an arbitr…
    CVE-2022-41401 (CVSS 6.5) — OpenRefine <= v3.5.2 contains a Server-Side Request Forgery (SSRF) vulnerability, which permits unauthorized u…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High