PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-104851 fsspec CVE debrief

The fsspec library is vulnerable to Server-Side Template Injection in ReferenceFileSystem, leading to Remote Code Execution. This occurs because fsspec.implementations.reference.ReferenceFileSystem parses a 'references' JSON document (Kerchunk format) and renders fields through un-sandboxed jinja2.Template(...).render(...) calls. An attacker controlling the JSON document can achieve arbitrary Python code execution on the victim machine by hosting it at a URL that the victim opens with fsspec.filesystem('reference', fo=URL) or via xarray.open_dataset('reference://...').

Vendor
fsspec
Product
filesystem_spec
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-05
Original CVE updated
2026-10-15
Advisory published
2026-10-05
Advisory updated
2026-10-15

Who should care

Defenders responsible for fsspec deployments, particularly those using versions from 0.9.0 onward, should assess exposure and prioritize remediation. This includes developers, security teams, and system administrators working with fsspec in Python environments.

Why it matters

CVE-2026-104851 is a Server-Side Template Injection vulnerability in fsspec's ReferenceFileSystem, leading to Remote Code Execution. Defenders should verify exposure, prioritize remediation, and implement compensating controls to mitigate potential risks.

  • Remote code execution risks require immediate attention and mitigation
  • Potential for arbitrary Python code execution on victim machines
  • Need for inventory checks and compensating controls to mitigate risks
  • Verification of fsspec versions and upgrades to secure versions is crucial

Technical summary

The fsspec library's ReferenceFileSystem implementation is vulnerable to Server-Side Template Injection due to un-sandboxed jinja2.Template(...).render(...) calls. This allows an attacker to achieve arbitrary Python code execution on the victim machine by controlling the 'references' JSON document. The vulnerability was introduced in commit 0fb8d56b684ee74ad9ad4587fd560bde1b116450 on 2021-03-12 and confirmed on the latest released version 2025.10.0. The affected code is located in fsspec/implementations/reference.py. Defenders should prioritize verifying exposure of fsspec versions from 0.9.0 onward and upgrading to version 2026.6.0 or later.

Defensive priority

Defenders should prioritize verifying exposure of fsspec versions from 0.9.0 onward and upgrading to version 2026.6.0 or later. Inventory checks and compensating controls should be implemented to mitigate potential code execution risks.

Recommended defensive actions

  • Verify fsspec versions from 0.9.0 onward and upgrade to version 2026.6.0 or later
  • Implement inventory checks to identify potentially vulnerable fsspec deployments
  • Apply compensating controls to mitigate potential code execution risks
  • Monitor for suspicious activity related to fsspec usage
  • Perform thorough vulnerability assessments to identify potential exposure
  • Review and update incident response plans to address potential code execution risks
  • Conduct regular security audits to ensure fsspec deployments are secure

Evidence notes

The vulnerability was introduced in commit 0fb8d56b684ee74ad9ad4587fd560bde1b116450 on 2021-03-12 and confirmed on the latest released version 2025.10.0. The affected code is located in fsspec/implementations/reference.py.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-104851 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-104851

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-104851 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-104851

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution

    Unverified legacy reference

    URL: https://storage.googleapis.com/osv-vulnerabilities/PyPI/PYSEC-2026-4217.json

    osv_dev

  • Source reference

    Unverified legacy reference

    URL: https://github.com/fsspec/filesystem_spec/security/advisories/GHSA-27vj-qcqg-25rc

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://github.com/fsspec/filesystem_spec/pull/2029

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://github.com/fsspec/filesystem_spec/pull/2039

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://github.com/fsspec/filesystem_spec/commit/86438783f93b1398ef245b92f0e6063b445b611c

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://github.com/fsspec/filesystem_spec/commit/a1c16ab3f07f354aa371c38f7b1b07ea7fd4c5c8

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://github.com/fsspec/filesystem_spec

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://github.com/fsspec/filesystem_spec/releases/tag/2026.6.0

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.