EUVD-2026-91720
GHSA-27vj-qcqg-25rc
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attacker-supplied reference document yields unauthenticated (PR:N) code execution with full C/I/A impact, but the victim must open the document (UI:R) and complexity is low (AC:L).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4Blast Radius
ecosystem impact- 8 pypi packages depend on fsspec (8 direct, 0 indirect)
Ecosystem-wide dependent count for version 0.9.0.
DescriptionCVE.org
fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0, fsspec.implementations.reference.ReferenceFileSystem evaluates fields from Kerchunk reference JSON documents through unrestricted jinja2.Template(...).render(...) calls in _process_references1._render_jinja, _process_templates, and _process_gen in fsspec/implementations/reference.py. A document supplied inline or fetched from an attacker-controlled URL can provide template expressions that execute Python code when the reference filesystem is opened, including through consumers such as xarray, before referenced data is read. The _process_gen path is reached whenever a document includes a gen array, while the other paths depend on template-related options and values. This issue is fixed in version 2026.6.0.
Articles & Coverage 1
AnalysisAI
Opening an attacker-controlled Kerchunk reference document with fsspec's ReferenceFileSystem can execute arbitrary Python code, because versions from 0.9.0 up to (but not including) 2026.6.0 render reference fields through unrestricted jinja2 templates instead of treating them as inert data. The vulnerability is exploitable by unauthenticated attackers but requires user interaction: the victim application - or a downstream consumer such as xarray - must actually open the malicious document, which can be supplied inline or fetched from an attacker-controlled URL, and the gen-array code path triggers with no special configuration at all. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The victim application must open or consume an fsspec ReferenceFileSystem (Kerchunk) reference document whose contents are attacker-controlled - supplied inline or fetched from an attacker-controlled URL - including indirectly through consumers like xarray. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are largely consistent and point to a genuine high-priority issue rather than an inflated CVSS score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade fsspec (filesystem_spec) to 2026.6.0, the first release in which jinja interpretation of reference manifests is opt-in via the new simple_references/simple_templates options; the fix landed through pull requests #2029 (https://github.com/fsspec/filesystem_spec/pull/2029) and #2039 (https://github.com/fsspec/filesystem_spec/pull/2039), with commits 86438783f93b1398ef245b92f0e6063b445b611c and a1c16ab3f07f354aa371c38f7b1b07ea7fd4c5c8. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify every system, image, notebook environment, and container that includes fsspec in versions from 0.9.0 up to but not including 2026.6.0, including transitive installs pulled in by data tooling such as xarray, and confirm whether those environments process Kerchunk reference documents originating outside the organization; until upgrade is complete, treat all such documents as untrusted executable content and restrict loading to internally generated or cryptographically verified sources. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today