Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.4
CVE-2026-108553: OpenRefine can run commands when a user visits a crafted page
CVE-2026-108553 · published 4 days ago
Summary
The OpenRefine tool (versions up to 3.10.1) can be tricked into running system commands if a logged‑in user clicks a specially crafted link on another website. An attacker could cause the OpenRefine program to execute commands on the server using the same rights as the OpenRefine user. Apply the latest OpenRefine update or restrict access to the tool to trusted users and networks.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | openrefine | openrefine | <= 3.10.1 |
| Debian:12 | debian | openrefine | All versions |
| Ubuntu:Pro:22.04:LTS | canonical | openrefine | All versions |
Original advisory text
OpenRefine through 3.10.1 CSRF to RCE via get-rows Command
OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, executing operating system commands as the OpenRefine user.
References
- https://github.com/OpenRefine/OpenRefine Product
- https://github.com/OpenRefine/OpenRefine/blob/bde8a36dc188f7846aeafc2910969e7d0f... Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-108553 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-1085... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-108553 Vendor Advisory
- https://www.vulncheck.com/advisories/openrefine-through-3.10.1-csrf-to-rce-via-g... Vendor Advisory
- https://github.com/OpenRefine/OpenRefine/issues/7999 Third Party Advisory
- https://github.com/OpenRefine/OpenRefine/blob/bde8a36dc188f7846aeafc2910969e7d0f... Third Party Advisory
- https://github.com/OpenRefine/OpenRefine/blob/bde8a36dc188f7846aeafc2910969e7d0f... Third Party Advisory
- https://ubuntu.com/security/CVE-2026-108553 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-108553 Third Party Advisory
- github.com/openrefine/openrefine/issues/7999 Third Party Advisory
- security-tracker.debian.org/tracker/cve-2026-108553 Third Party Advisory
- github.com/cveproject/cvelistv5/tree/main/cves/2026/108xxx/cve-2026-108553.json Third Party Advisory
- github.com/openrefine/openrefine Third Party Advisory
- github.com/openrefine/openrefine/blob/bde8a36dc188f7846aeafc2910969e7d0fbc8e7c/e... Third Party Advisory
- github.com/openrefine/openrefine/blob/bde8a36dc188f7846aeafc2910969e7d0fbc8e7c/m... Third Party Advisory
- github.com/openrefine/openrefine/blob/bde8a36dc188f7846aeafc2910969e7d0fbc8e7c/m... Third Party Advisory
- nvd.nist.gov/vuln/detail/cve-2026-108553 Third Party Advisory
- www.vulncheck.com/advisories/openrefine-through-3.10.1-csrf-to-rce-via-get-rows-... Third Party Advisory
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1150650 Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Severity
9.4
Critical
Type
CWE-352Cross-Site Request Forgery (CSRF)
Timeline
Published12 Oct 2026
Updated15 Oct 2026
First seen10 Oct 2026
Sources
CVE-2026-108553 · NVD
CVE-2026-108553 · MITRE
DEBIAN-CVE-2026-108553 · OSV
CVE-2026-108553 · OSV
UBUNTU-CVE-2026-108553 · OSV
Track software like this
Free during beta