{"id":"CVE-2026-108553","published":"2026-10-10T15:16:58.410","lastModified":"2026-10-16T17:25:57.940","description":"OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, executing operating system commands as the OpenRefine user.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-352"],"vendors":[],"products":[],"references":[{"url":"https://github.com/OpenRefine/OpenRefine","tags":[]},{"url":"https://github.com/OpenRefine/OpenRefine/blob/bde8a36dc188f7846aeafc2910969e7d0fbc8e7c/extensions/jython/src/com/google/refine/jython/JythonEvaluable.java#L142","tags":[]},{"url":"https://github.com/OpenRefine/OpenRefine/blob/bde8a36dc188f7846aeafc2910969e7d0fbc8e7c/main/src/com/google/refine/commands/row/GetRowsCommand.java#L174-L186","tags":[]},{"url":"https://github.com/OpenRefine/OpenRefine/blob/bde8a36dc188f7846aeafc2910969e7d0fbc8e7c/modules/core/src/main/java/com/google/refine/browsing/facets/ListFacet.java#L327-L339","tags":[]},{"url":"https://github.com/OpenRefine/OpenRefine/issues/7999","tags":[]},{"url":"https://www.vulncheck.com/advisories/openrefine-through-3.10.1-csrf-to-rce-via-get-rows-command","tags":[]}],"exploitRefs":[{"url":"https://github.com/OpenRefine/OpenRefine","tags":[]},{"url":"https://github.com/OpenRefine/OpenRefine/blob/bde8a36dc188f7846aeafc2910969e7d0fbc8e7c/extensions/jython/src/com/google/refine/jython/JythonEvaluable.java#L142","tags":[]},{"url":"https://github.com/OpenRefine/OpenRefine/blob/bde8a36dc188f7846aeafc2910969e7d0fbc8e7c/main/src/com/google/refine/commands/row/GetRowsCommand.java#L174-L186","tags":[]},{"url":"https://github.com/OpenRefine/OpenRefine/blob/bde8a36dc188f7846aeafc2910969e7d0fbc8e7c/modules/core/src/main/java/com/google/refine/browsing/facets/ListFacet.java#L327-L339","tags":[]},{"url":"https://github.com/OpenRefine/OpenRefine/issues/7999","tags":[]}],"hasPoc":true,"ai":{"summary":"OpenRefine contains a CSRF vulnerability in its get-rows command that allows remote attackers to execute arbitrary Jython facet expressions and OS commands as the OpenRefine user. This is particularly dangerous because it can lead to full system compromise when users visit malicious pages.","exploitability":"Exploitation requires luring a user to a malicious page with a crafted cross-origin GET request, making it moderately difficult but achievable with social engineering.","blast_radius":"The impact could be significant as the vulnerability allows execution of OS commands with the privileges of the OpenRefine process, potentially leading to complete system compromise if the service runs with elevated permissions.","remediation":"Upgrade to OpenRefine 3.11 or later to address this CSRF vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["csrf","rce","web","jython"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:11:36.996Z"}}