{"id":"UBUNTU-CVE-2026-108553","details":"OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, executing operating system commands as the OpenRefine user.","modified":"2026-10-13T15:17:03.763060751Z","published":"2026-10-12T00:00:00Z","upstream":["CVE-2026-108553"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-108553"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-108553"},{"type":"REPORT","url":"github.com/openrefine/openrefine/issues/7999"},{"type":"REPORT","url":"security-tracker.debian.org/tracker/cve-2026-108553"},{"type":"REPORT","url":"github.com/cveproject/cvelistv5/tree/main/cves/2026/108xxx/cve-2026-108553.json"},{"type":"REPORT","url":"github.com/openrefine/openrefine"},{"type":"REPORT","url":"github.com/openrefine/openrefine/blob/bde8a36dc188f7846aeafc2910969e7d0fbc8e7c/extensions/jython/src/com/google/refine/jython/jythonevaluable.java#l142"},{"type":"REPORT","url":"github.com/openrefine/openrefine/blob/bde8a36dc188f7846aeafc2910969e7d0fbc8e7c/main/src/com/google/refine/commands/row/getrowscommand.java#l174-l186"},{"type":"REPORT","url":"github.com/openrefine/openrefine/blob/bde8a36dc188f7846aeafc2910969e7d0fbc8e7c/modules/core/src/main/java/com/google/refine/browsing/facets/listfacet.java#l327-l339"},{"type":"REPORT","url":"nvd.nist.gov/vuln/detail/cve-2026-108553"},{"type":"REPORT","url":"www.vulncheck.com/advisories/openrefine-through-3.10.1-csrf-to-rce-via-get-rows-command"},{"type":"REPORT","url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1150650"}],"affected":[{"package":{"name":"openrefine","ecosystem":"Ubuntu:Pro:22.04:LTS","purl":"pkg:deb/ubuntu/openrefine?arch=source&distro=esm-apps%2Fjammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.5.2-1","3.5.2-1ubuntu0.1~esm1"],"ecosystem_specific":{"priority_reason":"Remote code execution as the OpenRefine user, but requires luring a user to a malicious page.","binaries":[{"binary_version":"3.5.2-1ubuntu0.1~esm1","binary_name":"openrefine"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-108553.json"}},{"package":{"name":"openrefine","ecosystem":"Ubuntu:Pro:24.04:LTS","purl":"pkg:deb/ubuntu/openrefine?arch=source&distro=esm-apps%2Fnoble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.2-3","3.7.6-1","3.7.7-1","3.7.7-1ubuntu0.1~esm1"],"ecosystem_specific":{"priority_reason":"Remote code execution as the OpenRefine user, but requires luring a user to a malicious page.","binaries":[{"binary_name":"openrefine","binary_version":"3.7.7-1ubuntu0.1~esm1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-108553.json"}},{"package":{"name":"openrefine","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/openrefine?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.8.7-1","3.8.7-2","3.9.5-2","3.9.5-2build1"],"ecosystem_specific":{"binaries":[{"binary_name":"openrefine","binary_version":"3.9.5-2build1"}],"priority_reason":"Remote code execution as the OpenRefine user, but requires luring a user to a malicious page."},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-108553.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"type":"Ubuntu","score":"high"}]}