High severity8.1NVD Advisory· Published Oct 24, 2024· Updated Jun 17, 2026
CVE-2024-47878
CVE-2024-47878
Description
OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the /extension/gdata/authorized endpoint includes the state GET parameter verbatim in a `` tag in the output, so without escaping. An attacker could lead or redirect a user to a crafted URL containing JavaScript code, which would then cause that code to be executed in the victim's browser as if it was part of OpenRefine. Version 3.8.3 fixes this issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.openrefine:extensionsMaven | < 3.8.3 | 3.8.3 |
Affected products
2- Range: < 3.8.3
Patches
Vulnerability mechanics
References
4- github.com/OpenRefine/OpenRefine/commit/10bf0874d67f1018a58b3732332d76b840192feanvdPatchWEB
- github.com/OpenRefine/OpenRefine/security/advisories/GHSA-pw3x-c5vp-mfc3nvdExploitThird Party AdvisoryWEB
- github.com/advisories/GHSA-pw3x-c5vp-mfc3ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-47878ghsaADVISORY
News mentions
0No linked articles in our index yet.