Threat database

CVE-2026-104851 is a high-severity code injection vulnerability in the fsspec filesystem_spec Python library. Versions from 0.9.0 up to but not including 2026.6.0 allow attacker-controlled Kerchunk reference JSON documents to execute arbitrary Python code via unsafe jinja2 template rendering when opening the reference filesystem. This can occur before any referenced data is read and affects multiple code paths depending on document content and options. The issue is fixed in version 2026.6.0.