CVE-2023-41887

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

OpenRefine is a powerful free, open source tool for working with messy data. Prior to version 3.7.5, a remote code execution vulnerability allows any unauthenticated user to execute code on the server. Version 3.7.5 has a patch for this issue.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
OpenRefine	OpenRefine	<= 3.7.4

References

https://github.com/OpenRefine/OpenRefine/commit/693fde606d4b5b78b16391c29d110389eb605511Patch
https://github.com/OpenRefine/OpenRefine/security/advisories/GHSA-p3r5-x3hr-gpg5Exploit, Vendor Advisory
https://github.com/OpenRefine/OpenRefine/commit/693fde606d4b5b78b16391c29d110389eb605511Patch
https://github.com/OpenRefine/OpenRefine/security/advisories/GHSA-p3r5-x3hr-gpg5Exploit, Vendor Advisory

Timeline

Published: Sep 15, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-418885.4GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk CVE-2023-418895.3SHIRASAGI is a Content Management System. Prior to version 1.18.0, SHIRASAGI is vulnerable to a Post-Unicode normalization issue. This happe CVE-2023-41894.8Cross-site Scripting (XSS) - Reflected in GitHub repository instantsoft/icms2 prior to 2.16.1-git.CVE-2023-418907.5Sustainsys.Saml2 library adds SAML2P support to ASP.NET web sites, allowing the web site to act as a SAML2 Service Provider. Prior to versi CVE-2023-418918.8FlyteAdmin is the control plane for Flyte responsible for managing entities and administering workflow executions. Prior to version 1.1.124,CVE-2023-418929.8Craft CMS is a platform for creating digital experiences. This is a high-impact, low-complexity attack vector. Users running Craft installat CVE-2023-418935.4Home assistant is an open source home automation. The audit team’s analyses confirmed that the `redirect_uri` and `client_id` are alterable CVE-2023-418945.3Home assistant is an open source home automation. The assessment verified that webhooks available in the webhook component are triggerable v CVE-2023-418959.6Home assistant is an open source home automation. The Home Assistant login page allows users to use their local Home Assistant credentials a CVE-2023-418969.0Home assistant is an open source home automation. Whilst auditing the frontend code to identify hidden parameters, Cure53 detected `auth_cal CVE-2023-418979.6Home assistant is an open source home automation. Home Assistant server does not set any HTTP security headers, including the X-Frame-Option CVE-2023-418987.8Home assistant is an open source home automation. The Home Assistant Companion for Android app up to version 2023.8.2 is vulnerable to arbit