The vulnerability exists in fsspec's ReferenceFileSystem implementation, which evaluates fields from Kerchunk reference JSON documents using unrestricted jinja2.Template(...).render(...) calls in the functions _process_references1._render_jinja, _process_templates, and _process_gen. An attacker supplying a malicious JSON document inline or via a URL can inject template expressions that execute arbitrary Python code when the filesystem is opened, including through consumers like xarray. The _process_gen function is invoked whenever the document includes a gen array, while the other vulnerable paths depend on template-related options. This improper control of code generation (CWE-94) leads to remote code execution. The issue is resolved in fsspec version 2026.6.0.

Successful exploitation allows an attacker to execute arbitrary Python code remotely with no privileges required and only user interaction needed. This can lead to full compromise of the environment running the vulnerable fsspec version, including confidentiality, integrity, and availability impacts. The CVSS v3.1 score is 8.8 (high), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Upgrade to fsspec version 2026.6.0 or later, where this code injection vulnerability is fixed. No other mitigations are documented. Users should avoid opening untrusted Kerchunk reference JSON documents with vulnerable versions. Patch status is confirmed fixed in 2026.6.0.