Read the docs
TI-2024-32133 Aliases CVE-2024-47879GHSA-3jm4-c6qf-jrh3

OpenRefine's PreviewExpressionCommand, which is eval, lacks protection against cross-site request forgery (CSRF)

Priority HIGH 73CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Tampering, Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-352 and CWE-94.

Summary

OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, lack of cross-site request forgery protection on the `preview-expression` command means that visiting a malicious website could cause an attacker-controlled expression to be executed. The expression can contain arbitrary Clojure or Python code. The attacker must know a valid project ID of a project that contains at least one row, and the attacker must convince the victim to open a malicious webpage. Version 3.8.3 fixes the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00428 37th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed OpenRefine (OpenRefine): 3.8.3org.openrefine:main (Maven): 3.8.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenRefineOpenRefinebefore 3.8.33.8.3Patch availableCNA
—org.openrefine:main (Maven)before 3.8.33.8.3Patch availableGHSA-3jm4-c6qf-jrh3
  • OpenRefine VendorOpenRefine Affected before 3.8.3 Fixed in 3.8.3 Patch available CNA
  • org.openrefine:main (Maven) Vendor— Affected before 3.8.3 Fixed in 3.8.3 Patch available GHSA-3jm4-c6qf-jrh3

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:openrefine:openrefine:*:*:*:*:*:*:*:*before 3.8.3VulnerableOpenRefine
  • cpe:2.3:a:openrefine:openrefine:*:*:*:*:*:*:*:* Versions before 3.8.3 Vulnerable ·OpenRefine

Remediation

  • Fix · CNA OpenRefine (OpenRefine) Fixed in 3.8.3
  • Fix · GHSA-3jm4-c6qf-jrh3 org.openrefine:main (Maven) Fixed in 3.8.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-47879
  2. 2026-10-03 Alias added: GHSA-3jm4-c6qf-jrh3

References

Exploit 1

Patch 1

Advisory 1

Other 1

  • TI-2023-22279 Remote Code exec in project import with mysql jdbc url attack CVSS 3.1CRITICAL 9.8
  • TI-2024-32135 OpenRefine's SQLite integration allows filesystem access, remote code execution (RCE) CVSS 3.1HIGH 8.8
  • TI-2023-22278 OpenRefine vulnerable to arbitrary file read in project import with mysql jdbc url attack CVSS 3.1HIGH 7.5
  • TI-2024-32134 OpenRefine has a reflected cross-site scripting vulnerability from POST request in ExportRowsCommand CVSS 3.1HIGH 8.1
  • TI-2024-32132 Reflected cross-site scripting vulnerability (XSS) in GData extension (authorized.vt) CVSS 3.1HIGH 8.1
  • TI-2022-19866 OpenRefine <= v3.5.2 contains a Server-Side Request Forgery (SSRF) vulnerability, which… CVSS 3.1MEDIUM 6.5
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences