#NØØT_Security_Alerts 🚨 #ALERT — OPENREFINE CSRF FLAW EXPOSES RUNNING DATA-ANALYSIS SESSIONS TO REMOTE CODE EXECUTION October 10, 2026 DISCLOSED BY: George Chen / VulnCheck PRODUCT: OpenRefine CVE: CVE-2026-108553 SEVERITY: High — CVSS 7.7 (v4.0) AFFECTED VERSIONS: OpenRefine 3.10.1 and earlier. IMPACT: A missing CSRF validation check in the get-rows command allows attacker-controlled requests to trigger Jython facet expressions. Successful exploitation can execute operating-system commands with the privileges of the OpenRefine process. EXPLOITATION STATUS: RESEARCH-DOCUMENTED RCE VULNERABILITY. The researcher published a detailed technical analysis identifying the vulnerable execution path. No confirmed malicious exploitation in the wild. EXPOSURE: The attack requires a running vulnerable OpenRefine instance and a victim visiting an attacker-controlled webpage. A crafted cross-origin GET request can target the local OpenRefine service without requiring the attacker to authenticate. Forensic triage: Inspect requests to /command/core/get-rows containing unexpected engine parameters or Jython expressions. Investigate suspicious Java child processes, shell execution, and unexpected local file modifications. No confirmed malicious IOCs have been published. URGENT ACTION: Restrict access to OpenRefine. Avoid browsing untrusted websites while vulnerable instances are running. Isolate sensitive OpenRefine sessions and monitor for suspicious local HTTP requests. No verified fixed release was identified. SOURCE: https://github.com/OpenRefine/OpenRefine/issues/7999 CVE: https://nvd.nist.gov/vuln/detail/CVE-2026-108553 CONFIDENCE: HIGH for the documented vulnerability mechanism, supported by the CNA record and source-level research. The upstream issue remains pending review. Independent exploitation and real-world attacks are unverified. #CyberSecurity #ThreatIntel #OpenRefine #RCE #CSRF #ApplicationSecurity