Read the docs
TI-2026-62939 Aliases CVE-2026-93349GHSA-4jpg-jrw7-h58p

Frictionless OS Command Injection via explore Console Command

Priority HIGH 72CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Frictionless before 5.19.1 contains an OS command injection vulnerability in the explore console command that allows an attacker who supplies a crafted Data Package descriptor to execute arbitrary operating system commands as the user who explores it. Attackers can place shell metacharacters in resource path values within a datapackage.json descriptor, which are passed unsanitized to os.system through a shell, causing arbitrary command execution in the victim's security context when they run the explore command against the untrusted package. This vulnerability was also addressed in version 5.20.0rc2 of the pre-release branch.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.02116 81st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed frictionless-py (frictionlessdata): 5.19.1, 5.20.0rc2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
frictionlessdatafrictionless-pybefore 5.19.1; 5.20.0rc1 to before 5.20.0rc25.19.1, 5.20.0rc2Patch availableCNA
  • frictionless-py Vendorfrictionlessdata Affected before 5.19.1; 5.20.0rc1 to before 5.20.0rc2 Fixed in 5.19.1, 5.20.0rc2 Patch available CNA

Remediation

  • Fix · CNA frictionless-py (frictionlessdata) Fixed in 5.19.1, 5.20.0rc2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-93349
  2. 2026-10-03 Alias added: GHSA-4jpg-jrw7-h58p

References

Exploit 1

Patch 1

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences