CVE-2026-108553

Name of the Vulnerable Software and Affected Versions OpenRefine versions prior to 3.10.2

Description A cross-site request forgery (CSRF) flaw exists in the get-rows command. This issue allows remote attackers to lure a user to a malicious page that issues a cross-origin GET request with a crafted engine parameter. This can trigger the execution of Jython facet expressions, enabling the attacker to execute operating system commands with the privileges of the OpenRefine process. The vulnerable endpoint is /command/core/get-rows.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to OpenRefine. Avoid browsing untrusted websites while OpenRefine instances are running. Isolate sensitive OpenRefine sessions and monitor for suspicious local HTTP requests.