CVE-2026-104851
- Source
- https://cve.org/CVERecord?id=CVE-2026-104851
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-104851.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2026-104851
- Aliases
- Downstream
CGA (28)
- CGA-3q7c-m7q9-fx5f
- CGA-4mpc-7g2w-8xmr
- CGA-4qqh-qgwr-x2m4
- CGA-5cfx-g8ww-524f
- CGA-8gv2-w2wv-49wp
- CGA-8qc8-mqjj-pv6q
- CGA-9jqm-h4pc-x7wc
- CGA-9wvr-3m99-f4x4
- CGA-f2fw-vg4r-hwj8
- CGA-fhw8-957w-63h8
- CGA-hhj8-6fmj-fxx2
- CGA-jmxc-wh5v-6ff9
- CGA-jq62-7429-2fpm
- CGA-pj3x-qvm5-cqfx
- CGA-pw57-qpww-3pm2
- CGA-pxf7-x583-7382
- CGA-pxfw-9vp9-46ph
- CGA-qg98-qv29-3288
- CGA-qj2f-xpq8-4fvh
- CGA-qm2g-xx44-c37f
- CGA-qm5p-hj2h-g4qv
- CGA-r37f-345f-3p4g
- CGA-rmmh-82q4-j77g
- CGA-w5cx-jwhx-7wv5
- CGA-w6r9-4xgj-q875
- CGA-w6x5-grcp-j68x
- CGA-x38q-r3m3-68jf
- CGA-x74f-hv76-6jjg
CLEANSTART (1)
DEBIAN (1)
MINI (15)
openSUSE (1)
ROOT (1)
UBUNTU (1)
- Related
- Published
- 2026-10-02T16:36:48Z
- Modified
- 2026-10-22T10:34:40Z
- Severity
-
- 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution
- Details
-
fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0, fsspec.implementations.reference.ReferenceFileSystem evaluates fields from Kerchunk reference JSON documents through unrestricted jinja2.Template(...).render(...) calls in _process_references1._render_jinja, _process_templates, and _process_gen in fsspec/implementations/reference.py. A document supplied inline or fetched from an attacker-controlled URL can provide template expressions that execute Python code when the reference filesystem is opened, including through consumers such as xarray, before referenced data is read. The _process_gen path is reached whenever a document includes a gen array, while the other paths depend on template-related options and values. This issue is fixed in version 2026.6.0.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-1336", "CWE-94" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104851.json" }- References
-
- https://github.com/fsspec/filesystem_spec/releases/tag/2026.6.0
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104851.json
- https://github.com/fsspec/filesystem_spec/security/advisories/GHSA-27vj-qcqg-25rc
- https://nvd.nist.gov/vuln/detail/CVE-2026-104851
- https://github.com/fsspec/filesystem_spec/commit/86438783f93b1398ef245b92f0e6063b445b611c
- https://github.com/fsspec/filesystem_spec/commit/a1c16ab3f07f354aa371c38f7b1b07ea7fd4c5c8
- https://github.com/fsspec/filesystem_spec/pull/2029
- https://github.com/fsspec/filesystem_spec/pull/2039
Affected packages
Git / github.com/fsspec/filesystem_spec
Affected ranges
- Type
- GIT
- Repo
- https://github.com/fsspec/filesystem_spec
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "0.9.0" }, { "fixed": "2026.6.0" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "fixed": "86438783f93b1398ef245b92f0e6063b445b611c" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "a1c16ab3f07f354aa371c38f7b1b07ea7fd4c5c8" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "2026.6.0", "range": [ { "fixed": "a2457004d03e0312f715f90f58873de5ab195a37" } ], "source": "REFERENCES_TAG" } ] }