CVE-2023-37476

CVSS 3.1: 7.8 high
EPSS: <1%p48
Published: Jul 17, 2023 · Jul 17, 2023
Modified: Jun 17, 2026

Analyze CVE-2023-37476 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

OpenRefine is a free, open source tool for data processing. A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution in the context of the OpenRefine process if a user can be convinced to import it. The vulnerability exists in all versions of OpenRefine up to and including 3.7.3. Users should update to OpenRefine 3.7.4 as soon as possible. Users unable to upgrade should only import OpenRefine projects from trusted sources.

Vendors: openrefine

Products: openrefine

Weakness: CWE-22

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.6%)

In the news

1 story

OpenRefine's Zip Slip Vulnerability Could Let Attackers Execute Malicious Code

The Hacker NewsOct 2, 08:02 UTC · Oct 2, 2023VulnerabilityCVE-2023-37476 CVE-2023-29357 CVE-2023-24955+12 · 1 read