OpenRefine EUVD-2026-96347

Exploitation requires that the victim is running an OpenRefine instance (default listener on localhost:3333) with a project loaded and an active session, AND that the victim is lured into visiting an attacker-controlled web page while that instance is running - the browser then issues the cross-origin GET to the get-rows command with an attacker-crafted engine parameter carrying a Jython facet expression. Limiting factors: mandatory user interaction (victim must visit the malicious page, UI:P), the high attack complexity and present attack requirements (AC:H/AT:P) reflecting the need for a precisely crafted engine/facet payload, and dependence on Jython expression evaluation being available in the running build. These conditions make drive-by mass exploitation impractical and favor targeted delivery against known OpenRefine users; because the forged request runs in the victim's own browser context, the attacker needs no credentials of their own (PR:N).

This is a genuine high-impact issue but with meaningful real-world friction. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:P, score 7.7) describes a network-reachable but non-trivial attack: PR:N means no attacker-side authentication, yet the high complexity (AC:H), present attack requirements (AT:P), and required victim interaction (UI:P) all indicate exploitation is conditional rather than trivially wormable. The impact triad VC:H/VI:H/VA:H is consistent with the description's claim of OS command execution as the OpenRefine user - a full RCE outcome. Exploitation status: no public exploit identified at time of analysis (not in CISA KEV, no POC flag in the input, no EPSS score provided). This means the primary risk signal is the credible technical chain documented by VulnCheck and the OpenRefine GitHub issue, not confirmed active exploitation. Net assessment: a real, patch-worthy flaw (CSRF chained to RCE is serious), but the combination of required user interaction, the need for the victim to have OpenRefine actively running with a project loaded, and the absence of KEV/EPSS/POC evidence places it below drop-everything urgency. Prioritize for OpenRefine operators and multi-user/shared deployments; treat as moderate for isolated single-user desktop installs. No conflicting signals in the data, but note EPSS is absent, so probabilistic exploitation likelihood could not be weighed.

An attacker crafts a web page that silently issues a cross-origin GET to a victim's locally running OpenRefine instance's get-rows command, embedding a malicious engine parameter containing a Jython facet expression. When a logged-in OpenRefine user with a project open visits the page, their browser sends the forged request, and OpenRefine evaluates the Jython expression, running operating-system commands as the OpenRefine process user. No public exploit code is identified at time of analysis, though VulnCheck has published a technical advisory describing the chain.