https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 18:42:46 +0000 https://vulnerability.circl.lu/vuln/cve-2026-104851 <p><strong>Affected:</strong> fsspec filesystem_spec</p> <p>fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0, fsspec.implementations.reference.ReferenceFileSystem evaluates fields from Kerchunk reference JSON documents through unrestricted jinja2.Template(...).render(...) calls in _process_references1._render_jinja, _process_templates, and _process_gen in fsspec/implementations/reference.py. A document supplied inline or fetched from an attacker-controlled URL can provide template expressions that execute Python code when the reference filesystem is opened, including through consumers such as xarray, before referenced data is read. The _process_gen path is reached whenever a document includes a gen array, while the other paths depend on template-related options and values. This issue is fixed in version 2026.6.0.</p> <p><strong>Affected:</strong> fsspec filesystem_spec</p> <p>fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0, fsspec.implementations.reference.ReferenceFileSystem evaluates fields from Kerchunk reference JSON documents through unrestricted jinja2.Template(...).render(...) calls in _process_references1._render_jinja, _process_templates, and _process_gen in fsspec/implementations/reference.py. A document supplied inline or fetched from an attacker-controlled URL can provide template expressions that execute Python code when the reference filesystem is opened, including through consumers such as xarray, before referenced data is read. The _process_gen path is reached whenever a document includes a gen array, while the other paths depend on template-related options and values. This issue is fixed in version 2026.6.0.</p> https://vulnerability.circl.lu/vuln/cve-2026-104851 https://vulnerability.circl.lu/vuln/ghsa-27vj-qcqg-25rc <p><strong>Affected:</strong> PyPI: fsspec</p> <p>### Summary</p> <p>`fsspec.implementations.reference.ReferenceFileSystem` parses a &#34;references&#34; JSON document (Kerchunk format) supplied either inline or via a URL. The parser renders fields from this JSON through **un-sandboxed** `jinja2.Template(...).render(...)` calls in three locations. An attacker who controls the JSON document — typically by hosting it at a URL that the victim opens with `fsspec.filesystem(&#34;reference&#34;, fo=URL)` or via `xarray.open_dataset(&#34;reference://...&#34;)` — achieves arbitrary Python code execution on the victim machine, before any data is read.</p> <p>This mirrors the pattern of [CVE-2024-34359](https://nvd.nist.gov/vuln/detail/CVE-2024-34359) in `llama-cpp-python`, where externally-sourced template strings were rendered with the default unrestricted Jinja2 environment.</p> <p>### Affected versions</p> <p>All versions of `fsspec` from `0.9.0` onward (vulnerable code introduced in commit `0fb8d56b684ee74ad9ad4587fd560bde1b116450`, 2021-03-12). Confirmed on the latest released version `2025.10.0`.</p> <p>### Affected sinks</p> <p>All in `fsspec/implementations/reference.py`:</p> <p>| Sink | Location | Trigger | |---|---|---| | A — `_process_references1._render_jinja` | lines 1016-1018 | `simple_templates=False` and a `refs` entry contains `{{` | | B — `_process_templates` (lambda) | lines 1043-1053 | `templates` dict has values containing `{{`, invoked later via render context | | C — `_process_gen` | lines 1075-1083 | references JSON contains a `gen` array (always reached, regardless of `sim…</p> <p><strong>Affected:</strong> PyPI: fsspec</p> <p>### Summary</p> <p>`fsspec.implementations.reference.ReferenceFileSystem` parses a &#34;references&#34; JSON document (Kerchunk format) supplied either inline or via a URL. The parser renders fields from this JSON through **un-sandboxed** `jinja2.Template(...).render(...)` calls in three locations. An attacker who controls the JSON document — typically by hosting it at a URL that the victim opens with `fsspec.filesystem(&#34;reference&#34;, fo=URL)` or via `xarray.open_dataset(&#34;reference://...&#34;)` — achieves arbitrary Python code execution on the victim machine, before any data is read.</p> <p>This mirrors the pattern of [CVE-2024-34359](https://nvd.nist.gov/vuln/detail/CVE-2024-34359) in `llama-cpp-python`, where externally-sourced template strings were rendered with the default unrestricted Jinja2 environment.</p> <p>### Affected versions</p> <p>All versions of `fsspec` from `0.9.0` onward (vulnerable code introduced in commit `0fb8d56b684ee74ad9ad4587fd560bde1b116450`, 2021-03-12). Confirmed on the latest released version `2025.10.0`.</p> <p>### Affected sinks</p> <p>All in `fsspec/implementations/reference.py`:</p> <p>| Sink | Location | Trigger | |---|---|---| | A — `_process_references1._render_jinja` | lines 1016-1018 | `simple_templates=False` and a `refs` entry contains `{{` | | B — `_process_templates` (lambda) | lines 1043-1053 | `templates` dict has values containing `{{`, invoked later via render context | | C — `_process_gen` | lines 1075-1083 | references JSON contains a `gen` array (always reached, regardless of `sim…</p> https://vulnerability.circl.lu/vuln/ghsa-27vj-qcqg-25rc