CVE-2026-108553
Publication date 12 October 2026
Last updated 12 October 2026
Ubuntu priority
Description
OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, executing operating system commands as the OpenRefine user.
Why is this CVE high priority?
Remote code execution as the OpenRefine user, but requires luring a user to a malicious page.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| openrefine | 26.04 LTS resolute |
Needs evaluation
|
| 24.04 LTS noble |
Needs evaluation
|
|
| 22.04 LTS jammy |
Needs evaluation
|
|
| 20.04 LTS focal | Not in release | |
| 18.04 LTS bionic | Not in release | |
| 16.04 LTS xenial | Not in release | |
| 14.04 LTS trusty | Not in release |
Severity score breakdown
CVSS version: CVSS v4.0
Base score
7.7 · High
Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
Other references
- https://www.cve.org/CVERecord?id=CVE-2026-108553
- github.com/openrefine/openrefine/issues/7999
- security-tracker.debian.org/tracker/cve-2026-108553
- github.com/cveproject/cvelistv5/tree/main/cves/2026/108xxx/cve-2026-108553.json
- github.com/openrefine/openrefine
- github.com/openrefine/openrefine/blob/bde8a36dc188f7846aeafc2910969e7d0fbc8e7c/extensions/jython/src/com/google/refine/jython/jythonevaluable.java#l142
- github.com/openrefine/openrefine/blob/bde8a36dc188f7846aeafc2910969e7d0fbc8e7c/main/src/com/google/refine/commands/row/getrowscommand.java#l174-l186
- github.com/openrefine/openrefine/blob/bde8a36dc188f7846aeafc2910969e7d0fbc8e7c/modules/core/src/main/java/com/google/refine/browsing/facets/listfacet.java#l327-l339
- nvd.nist.gov/vuln/detail/cve-2026-108553
- www.vulncheck.com/advisories/openrefine-through-3.10.1-csrf-to-rce-via-get-rows-command
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1150650