Read the docs
TI-2024-32136 Aliases CVE-2024-47882GHSA-j8hp-f2mj-586g

OpenRefine's error page lacks escaping, leading to potential Cross-site Scripting on import of malicious project

Priority MEDIUM 60CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the built-in "Something went wrong!" error page includes the exception message and exception traceback without escaping HTML tags, enabling injection into the page if an attacker can reliably produce an error with an attacker-influenced message. It appears that the only way to reach this code in OpenRefine itself is for an attacker to somehow convince a victim to import a malicious file, which may be difficult. However, out-of-tree extensions may add their own calls to `respondWithErrorPage`. Version 3.8.3 has a fix for this issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0051 43rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed OpenRefine (OpenRefine): 3.8.3org.openrefine:openrefine (Maven): 3.8.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenRefineOpenRefinebefore 3.8.33.8.3Patch availableCNA
—org.openrefine:openrefine (Maven)before 3.8.33.8.3Patch availableGHSA-j8hp-f2mj-586g
  • OpenRefine VendorOpenRefine Affected before 3.8.3 Fixed in 3.8.3 Patch available CNA
  • org.openrefine:openrefine (Maven) Vendor— Affected before 3.8.3 Fixed in 3.8.3 Patch available GHSA-j8hp-f2mj-586g

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:openrefine:openrefine:*:*:*:*:*:*:*:*before 3.8.3VulnerableOpenRefine
  • cpe:2.3:a:openrefine:openrefine:*:*:*:*:*:*:*:* Versions before 3.8.3 Vulnerable ·OpenRefine

Remediation

  • Fix · CNA OpenRefine (OpenRefine) Fixed in 3.8.3
  • Fix · GHSA-j8hp-f2mj-586g org.openrefine:openrefine (Maven) Fixed in 3.8.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-47882
  2. 2026-10-03 Alias added: GHSA-j8hp-f2mj-586g

References

Exploit 1

Patch 1

Advisory 1

Other 2

  • TI-2023-22279 Remote Code exec in project import with mysql jdbc url attack CVSS 3.1CRITICAL 9.8
  • TI-2024-32135 OpenRefine's SQLite integration allows filesystem access, remote code execution (RCE) CVSS 3.1HIGH 8.8
  • TI-2024-32133 OpenRefine's PreviewExpressionCommand, which is eval, lacks protection against cross-site request forgery (CSRF) CVSS 3.1HIGH 8.8
  • TI-2023-22278 OpenRefine vulnerable to arbitrary file read in project import with mysql jdbc url attack CVSS 3.1HIGH 7.5
  • TI-2024-32134 OpenRefine has a reflected cross-site scripting vulnerability from POST request in ExportRowsCommand CVSS 3.1HIGH 8.1
  • TI-2024-32132 Reflected cross-site scripting vulnerability (XSS) in GData extension (authorized.vt) CVSS 3.1HIGH 8.1
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences