CVE-2026-108553

HighCVSS 7.5

Published: 10/10/2026(UTC)Updated: 18/10/2026(UTC)Translated: 10/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

8th percentile - higher than 8% of all known CVEs

Summary

Cross-site request forgery vulnerability in OpenRefine up to version 3.10.1 in the get-rows command. Allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, executing operating system commands as the OpenRefine user.

Risk Assessment

An attacker could execute arbitrary system commands on the server, potentially leading to full system compromise and data theft.

Recommendation

Update OpenRefine to a version above 3.10.1 if available. Additionally, protect the application against CSRF, e.g., by verifying the Origin header.

Other vulnerabilities in OpenRefine

CVE-2023-37476Medium
OpenRefine is a free, open source tool for data processing that contains a vulnerability allowing arbitrary code execution in the context of the OpenRefine process. A malicious OpenRefine project tar file can be exploited if a user is convinced to import it.

Original NVD description (English source)

OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, executing operating system commands as the OpenRefine user.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS