OpenRefine vulnerabilities

CVEs per yearBy the year they were published

1. 20233
2. 20248
3. 20261

Newest CVEs

• CVE-2026-108553

  OpenRefine through 3.10.1 CSRF to RCE via get-rows Command

  OpenRefine · OpenRefine

  High7.7
• CVE-2024-49760

  OpenRefine has a path traversal in LoadLanguageCommand

  OpenRefine · OpenRefine

  High7.1
• CVE-2024-47883

  Butterfly has path/URL confusion in resource handling leading to multiple weaknesses

  OpenRefine · simile-butterfly

  Critical9.1
• CVE-2024-47882

  OpenRefine's error page lacks escaping, leading to potential Cross-site Scripting on import of malicious project

  OpenRefine · OpenRefine

  Medium5.9
• CVE-2024-47881

  OpenRefine's SQLite integration allows filesystem access, remote code execution (RCE)

  OpenRefine · OpenRefine

  High8.1
• CVE-2024-47880

  OpenRefine has a reflected cross-site scripting vulnerability from POST request in ExportRowsCommand

  OpenRefine · OpenRefine

  High8.1
• CVE-2024-47879

  OpenRefine's PreviewExpressionCommand, which is eval, lacks protection against cross-site request forgery (CSRF)

  OpenRefine · OpenRefine

  High7.6
• CVE-2024-47878

  Reflected cross-site scripting vulnerability (XSS) in GData extension (authorized.vt)

  OpenRefine · OpenRefine

  High8.1
• CVE-2024-23833

  OpenRefine JDBC Attack Vulnerability

  OpenRefine · OpenRefine

  High7.5
• CVE-2023-41887

  Remote Code exec in project import with mysql jdbc url attack

  OpenRefine · OpenRefine

  Critical9.8