CVE-2026-108553: OpenRefine through 3.10.1 CSRF to RCE via get-rows Command
OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, executing operating system commands as the OpenRefine user.
Affected Software
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
The attacker must lure a user into visiting a malicious page. That page issues a cross-origin GET request with a crafted engine parameter to trigger execution of a Jython facet expression.
Is authentication required for exploitation?
No privileges are required by the attacker, but user interaction is required. The affected OpenRefine instance must be reachable by the victim's browser for the cross-origin request to be sent.
What level of access could successful exploitation provide?
Successful exploitation can execute operating system commands as the user account running OpenRefine. This can affect confidentiality, integrity, and availability of resources accessible to that account.