CVE-2026-108553
OpenRefine through 3.10.1 CSRF to RCE via get-rows Command
OpenRefine OpenRefine
CVSS
7.7HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 7% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, executing operating system commands as the OpenRefine user.
Text from CVE List
Affected versions 1
- OpenRefineaffected: all versions through 3.10.1CVE List
References 6
- vulncheck.com/advisories/openrefine-through-3.10.1-csrf-to-rce-via-get-rows-commandAdvisoryvia CVE List
- github.com/OpenRefine/OpenRefine/issues/7999Referencevia CVE List
- github.com/OpenRefine/OpenRefineReferencevia CVE List
- github.com/OpenRefine/OpenRefine/blob/bde8a36dc188f7846aeafc2910969e7d0fbc8e7c/main/src/com/google/refine/commands/row/GetRowsCommand.java#L174-L186Referencevia CVE List
- github.com/OpenRefine/OpenRefine/blob/bde8a36dc188f7846aeafc2910969e7d0fbc8e7c/modules/core/src/main/java/com/google/refine/browsing/facets/ListFacet.java#L327-L339Referencevia CVE List
- github.com/OpenRefine/OpenRefine/blob/bde8a36dc188f7846aeafc2910969e7d0fbc8e7c/extensions/jython/src/com/google/refine/jython/JythonEvaluable.java#L142Referencevia CVE List