CVE-2026-108553

Summary

OpenRefine contains a CSRF vulnerability in its get-rows command that allows remote attackers to execute arbitrary Jython facet expressions and OS commands as the OpenRefine user. This is particularly dangerous because it can lead to full system compromise when users visit malicious pages.

Exploitability

Exploitation requires luring a user to a malicious page with a crafted cross-origin GET request, making it moderately difficult but achievable with social engineering.

Blast radius

The impact could be significant as the vulnerability allows execution of OS commands with the privileges of the OpenRefine process, potentially leading to complete system compromise if the service runs with elevated permissions.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to OpenRefine 3.11 or later to address this CSRF vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.