{"items":[{"id":"NVI-00013009","kind":"vulnerability","title":"fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-27vj-qcqg-25rc","CVE-2026-104851"],"plain_summary":"GitHub lists this reviewed advisory for fsspec. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-11eef8fa5f08cbf2cfa5115b48e4e08c"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-05T22:53:23.000Z","value":"8.8 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-37c27ba699729d300e331ca1bec18f24"},{"kind":"CVSS","as_of":"2026-10-05T20:17:09.373Z","value":"8.8 HIGH (3.1)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-11eef8fa5f08cbf2cfa5115b48e4e08c"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-37c27ba699729d300e331ca1bec18f24","url":"https://github.com/advisories/GHSA-27vj-qcqg-25rc","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-27vj-qcqg-25rc","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T01:39:10.636Z"},{"id":"sr-11eef8fa5f08cbf2cfa5115b48e4e08c","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104851","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-104851","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-03T09:58:14.367Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-37c27ba699729d300e331ca1bec18f24"],"technology":"fsspec","known_exclusions":[],"conditions_summary":"### Summary\n\n`fsspec.implementations.reference.ReferenceFileSystem` parses a \"references\"\nJSON document (Kerchunk format) supplied either inline or via a URL. The\nparser renders fields from this JSON through **un-sandboxed**\n`jinja2.Template(...).render(...)` calls in three locations. An attacker who\ncontrols the JSON document — typically by hosting it at a URL that the\nvictim opens with `fsspec.filesystem(\"reference\", fo=URL)` or via\n`xarray.open_dataset(\"reference://...\")` — achieves arbitrary Python code\nexecution on the victim machine, before any data is read.\n\nThis mirrors the pattern of CVE-2024-34359\nin `llama-cpp-python`, where externally-sourced template strings were\nrendered with the default unrestricted Jinja2 environment.\n\n### Affected versions\n\nAll versions of `fsspec` from `0.9.0` onward (vulnerable code introduced in\ncommit `0fb8d56b684ee74ad9ad4587fd560bde1b116450`, 2021-03-12). Confirmed on\nthe latest released version `2025.10.0`.\n\n### Affected sinks\n\nAll in `fsspec/implementations/reference.py`:\n\n| Sink | Location | Trigger |\n|---|---|---|\n| A — `_process_references1._render_jinja` | lines 1016-1018 | `simple_temp","public_affected_ranges":[">= 0.9.0, < 2026.6.0"]}],"null_published_at":"2026-11-03T10:03:31.370Z","source_updated_at":"2026-10-05T22:53:23.000Z","source_disclosed_at":"2026-10-05T22:53:22.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-11-01T01:39:10.636Z"},{"id":"NVI-00013009","kind":"vulnerability","title":"fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-27vj-qcqg-25rc","CVE-2026-104851"],"plain_summary":"GitHub lists this reviewed advisory for fsspec. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-37c27ba699729d300e331ca1bec18f24"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-05T22:53:23.000Z","value":"8.8 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-37c27ba699729d300e331ca1bec18f24"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-37c27ba699729d300e331ca1bec18f24","url":"https://github.com/advisories/GHSA-27vj-qcqg-25rc","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-27vj-qcqg-25rc","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T01:39:10.636Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-37c27ba699729d300e331ca1bec18f24"],"technology":"fsspec","known_exclusions":[],"conditions_summary":"### Summary\n\n`fsspec.implementations.reference.ReferenceFileSystem` parses a \"references\"\nJSON document (Kerchunk format) supplied either inline or via a URL. The\nparser renders fields from this JSON through **un-sandboxed**\n`jinja2.Template(...).render(...)` calls in three locations. An attacker who\ncontrols the JSON document — typically by hosting it at a URL that the\nvictim opens with `fsspec.filesystem(\"reference\", fo=URL)` or via\n`xarray.open_dataset(\"reference://...\")` — achieves arbitrary Python code\nexecution on the victim machine, before any data is read.\n\nThis mirrors the pattern of CVE-2024-34359\nin `llama-cpp-python`, where externally-sourced template strings were\nrendered with the default unrestricted Jinja2 environment.\n\n### Affected versions\n\nAll versions of `fsspec` from `0.9.0` onward (vulnerable code introduced in\ncommit `0fb8d56b684ee74ad9ad4587fd560bde1b116450`, 2021-03-12). Confirmed on\nthe latest released version `2025.10.0`.\n\n### Affected sinks\n\nAll in `fsspec/implementations/reference.py`:\n\n| Sink | Location | Trigger |\n|---|---|---|\n| A — `_process_references1._render_jinja` | lines 1016-1018 | `simple_temp","public_affected_ranges":[">= 0.9.0, < 2026.6.0"]}],"null_published_at":"2026-11-01T07:29:12.908Z","source_updated_at":"2026-10-05T22:53:23.000Z","source_disclosed_at":"2026-10-05T22:53:22.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-01T01:39:10.636Z"}],"next_cursor":null,"snapshot_revision":"42594"}