We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, lack of cross-site request forgery protection on the `preview-expression` command means that visiting a malicious website could cause an attacker-controlled expression to be executed. The expression can contain arbitrary Clojure or Python code. The attacker must know a valid project ID of a project that contains at least one row, and the attacker must convince the victim to open a malicious webpage. Version 3.8.3 fixes the issue.
Reserved 2024-10-04 | Published 2024-10-24 | Updated 2024-10-25 | Assigner GitHub_MCWE-352: Cross-Site Request Forgery (CSRF)
CWE-94: Improper Control of Generation of Code ('Code Injection')
github.com/...Refine/security/advisories/GHSA-3jm4-c6qf-jrh3
github.com/...ommit/090924ca923489b6c94397cf1f5df7f7f78f0126
Support options