fsspec CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH fsspec CVE published 2026-10-05

CVE-2026-104851

The fsspec library is vulnerable to Server-Side Template Injection in ReferenceFileSystem, leading to Remote Code Execution. This occurs because fsspec.implementations.reference.ReferenceFileSystem parses a 'references' JSON document (Kerchunk format) and renders fields through un-sandboxed jinja2.Template(...).render(...) calls. An attacker controlling the JSON document can achieve arbitrary Python code [truncated]