MinorCritical vulnerability

CVE-2026-108553 (CVSS 7.7)

NVD · officialPublished Oct 10, 2026Risk 23/100

OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, executing operating system commands as the OpenRefine user.

Technical details

CVSS

7.7

AV:NetworkAC:HighPR:NoneUI:Passive

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source