OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython… (CVE-2026-108553)
Description
OpenRefine versions through 3.10.1 have a cross-site request forgery (CSRF) vulnerability in the get-rows command. This flaw allows remote attackers to execute Jython facet expressions by tricking a user into visiting a malicious page that issues a crafted cross-origin GET request. Successful exploitation can lead to execution of operating system commands with the privileges of the OpenRefine user.
CVSS v3.1
Score 7.5high
Affected software
pkg:github/openrefine/OpenRefineRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in OpenRefine up to version 3.10.1 is a CSRF issue affecting the get-rows command. It permits remote attackers to execute arbitrary Jython facet expressions by leveraging a crafted engine parameter in a cross-origin GET request. This can result in execution of OS commands under the OpenRefine user's context, posing a high risk of system compromise.
Potential Impact
Exploitation can lead to remote code execution on the host running OpenRefine, with the privileges of the OpenRefine user. This impacts confidentiality, integrity, and availability, as indicated by the CVSS vector (C:H/I:H/A:H). The attack requires user interaction (UI:R) and has a high attack complexity (AC:H).
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid visiting untrusted web pages while OpenRefine is running and consider restricting network access to the OpenRefine service to trusted users only.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-3fgg-hmv4-hp49
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-108553"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6acaad812cdf04f6565142ae
Added to database: 10/10/2026, 21:26:25 UTC
Last enriched: 10/10/2026, 21:29:18 UTC
Last updated: 10/10/2026, 22:48:23 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.