CVE-2026-93349

Name of the Vulnerable Software and Affected Versions Frictionless versions prior to 5.20.0rc1

Description An OS command injection flaw exists in the explore console command. An attacker can execute arbitrary operating system commands by providing a crafted Data Package descriptor. By placing shell metacharacters in resource path values within the datapackage.json descriptor, the input is passed unsanitized to the os.system() function through a shell, leading to command execution within the security context of the user running the explore command.

Recommendations Update Frictionless to version 5.20.0rc1 or later.