OpenRefine vulnerabilities
We track 8 vulnerabilities in OpenRefine products across 4 products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on October 10, 2026.
Latest OpenRefine vulnerabilities
- 7.5 High severity
OpenRefine: Cross-Site Request Forgery
OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engi
- 9.1 Critical severity
simile-butterfly: Improper Limitation of a Pathname to a Restricted Directory
The OpenRefine fork of the MIT Simile Butterfly server is a modular web application framework. The Butterfly framework uses the `java.net.URL` class to refer to (what are expected to be) local resource files, like images or templates. This works: "opening a co
- 8.8 High severity
OpenRefine: Improper Neutralization of Special Elements used in an SQL Command
OpenRefine is a free, open source tool for working with messy data. Starting in version 3.4-beta and prior to version 3.8.3, in the `database` extension, the "enable_load_extension" property can be set for the SQLite integration, enabling an attacker to load (
- 8.8 High severity
OpenRefine: Cross-Site Request Forgery
OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, lack of cross-site request forgery protection on the `preview-expression` command means that visiting a malicious website could cause an attacker-controlled expression
- 7.5 High severity
OpenRefine: Incorrect Authorization
OpenRefine is a free, open source power tool for working with messy data and improving it. A jdbc attack vulnerability exists in OpenRefine(version<=3.7.7) where an attacker may construct a JDBC query which may read files on the host filesystem. Due to the new
- 9.8 Critical severity
OpenRefine: Improper Neutralization of Special Elements used in an SQL Command
OpenRefine is a powerful free, open source tool for working with messy data. Prior to version 3.7.5, a remote code execution vulnerability allows any unauthenticated user to execute code on the server. Version 3.7.5 has a patch for this issue.
- 7.5 High severity
OpenRefine: Improper Neutralization of Special Elements used in an SQL Command
OpenRefine is a powerful free, open source tool for working with messy data. Prior to version 3.7.5, an arbitrary file read vulnerability allows any unauthenticated user to read a file on a server. Version 3.7.5 fixes this issue.
- 7.8 High severity
OpenRefine: Improper Limitation of a Pathname to a Restricted Directory
OpenRefine is a free, open source tool for data processing. A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution in the context of the OpenRefine process if a user can be convinced to import it. The vulnerab