Cette page suit l'état du correctif pour Ubuntu. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2026-108553 →
UBUNTU-CVE-2026-108553
OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython f...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, executing operating system commands as the OpenRefine user.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Ubuntu:Pro:22.04:LTS
openrefine
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:24.04:LTS
openrefine
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:26.10
openrefine
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:26.04:LTS
openrefine
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Références
- report ubuntu.com
- report cve.org
- report github.com/openrefine/openrefine/issues/7999
- report security-tracker.debian.org/tracker/cve-2026-108553
- report github.com/cveproject/cvelistv5/tree/main/cves/2026/108xxx/cve-2026-108553.json
- report github.com/openrefine/openrefine
- report github.com/openrefine/openrefine/blob/bde8a36dc188f7846aeafc2910969e7d0fbc8e7c/extensions/jython/src/com/google/refine/jython/jythonevaluable.java#l142
- report github.com/openrefine/openrefine/blob/bde8a36dc188f7846aeafc2910969e7d0fbc8e7c/main/src/com/google/refine/commands/row/getrowscommand.java#l174-l186
- report github.com/openrefine/openrefine/blob/bde8a36dc188f7846aeafc2910969e7d0fbc8e7c/modules/core/src/main/java/com/google/refine/browsing/facets/listfacet.java#l327-l339
- report nvd.nist.gov/vuln/detail/cve-2026-108553
- report vulncheck.com/advisories/openrefine-through-3.10.1-csrf-to-rce-via-get-rows-command
- report bugs.debian.org