High severity7.5NVD Advisory· Published Oct 10, 2026
CVE-2026-108553
CVE-2026-108553
Description
OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, executing operating system commands as the OpenRefine user.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <=3.10.1
Patches
Vulnerability mechanics
References
5- github.com/OpenRefine/OpenRefine/blob/bde8a36dc188f7846aeafc2910969e7d0fbc8e7c/extensions/jython/src/com/google/refine/jython/JythonEvaluable.javanvd
- github.com/OpenRefine/OpenRefine/blob/bde8a36dc188f7846aeafc2910969e7d0fbc8e7c/main/src/com/google/refine/commands/row/GetRowsCommand.javanvd
- github.com/OpenRefine/OpenRefine/blob/bde8a36dc188f7846aeafc2910969e7d0fbc8e7c/modules/core/src/main/java/com/google/refine/browsing/facets/ListFacet.javanvd
- github.com/OpenRefine/OpenRefine/issues/7999nvd
- www.vulncheck.com/advisories/openrefine-through-3.10.1-csrf-to-rce-via-get-rows-commandnvd
News mentions
0No linked articles in our index yet.