OpenRefine CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH OpenRefine CVE published 2026-10-10

CVE-2026-108553

OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. This vulnerability can be exploited by luring a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, potentially leading to execution of operating system commands as the OpenRefine user. Defenders should asse [truncated]