Read the docs
TI-2026-66136 Aliases CVE-2026-104851GHSA-27vj-qcqg-25rc

fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution

Priority HIGH 73CWE-1336Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 8 fixed, 7 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-1336.

Summary

fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0, fsspec.implementations.reference.ReferenceFileSystem evaluates fields from Kerchunk reference JSON documents through unrestricted jinja2.Template(...).render(...) calls in _process_references1._render_jinja, _process_templates, and _process_gen in fsspec/implementations/reference.py. A document supplied inline or fetched from an attacker-controlled URL can provide template expressions that execute Python code when the reference filesystem is opened, including through consumers such as xarray, before referenced data is read. The _process_gen path is reached whenever a document includes a gen array, while the other paths depend on template-related options and values. This issue is fixed in version 2026.6.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00475 41st percentileScored 2026-11-07
Fix Partial filesystem_spec (fsspec): 2026.6.0fsspec (PyPI): 2026.6.0Red Hat: 15 advisoriesRed Hat: 8 fixed, 7 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
fsspecfilesystem_spec0.9.0 to before 2026.6.02026.6.0Patch availableCNA
—fsspec (PyPI)0.9.0 to before 2026.6.02026.6.0Patch availableGHSA-27vj-qcqg-25rc
  • filesystem_spec Vendorfsspec Affected 0.9.0 to before 2026.6.0 Fixed in 2026.6.0 Patch available CNA
  • fsspec (PyPI) Vendor— Affected 0.9.0 to before 2026.6.0 Fixed in 2026.6.0 Patch available GHSA-27vj-qcqg-25rc

Remediation

  • Fix · CNA filesystem_spec (fsspec) Fixed in 2026.6.0
  • Fix · GHSA-27vj-qcqg-25rc fsspec (PyPI) Fixed in 2026.6.0 Advisory →

Red Hat 15 advisories

  • RHSA-2026:94631 Released 2026-11-03 · Red Hat rating Critical
    GuideLLM 3.5.1
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/guidellm-rhel9
  • RHSA-2026:92510 Released 2026-10-29 · Red Hat rating Critical
    RHOAI 3.4.6 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-cli-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
  • RHSA-2026:90440 Released 2026-10-26 · Red Hat rating Important
    Red Hat Enterprise Linux AI 3.4.6 security update
    • Red Hat Enterprise Linux AI 3.4 registry.redhat.io/rhelai3/bootc-aws-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9 +3
Show 12 more Red Hat advisories
  • RHSA-2026:90432 Released 2026-10-26 · Red Hat rating Important
    Red Hat Enterprise Linux AI 3.4.6 security update
    • Red Hat Enterprise Linux AI 3.4 registry.redhat.io/rhelai3/disk-image-cuda-rhel9
  • RHSA-2026:87410 Released 2026-10-21 · Red Hat rating Critical
    RHOAI 2.25.12 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9 +47
  • RHSA-2026:87124 Released 2026-10-21 · Red Hat rating Critical
    Red Hat Ansible Automation Platform 2.7 Container Release Update
    • Red Hat Ansible Automation Platform 2.7 registry.redhat.io/ansible-automation-platform-27/de-supported-rhel9, registry.redhat.io/ansible-automation-platform-27/eda-controller-rhel9, registry.redhat.io/ansible-automation-platform-27/ee-supported-rhel9 +8
  • RHSA-2026:87120 Released 2026-10-21 · Red Hat rating Critical
    Red Hat Ansible Automation Platform 2.6 Container Release Update
    • Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/eda-controller-rhel9, registry.redhat.io/ansible-automation-platform-26/ee-supported-rhel9, registry.redhat.io/ansible-automation-platform-26/gateway-rhel9 +8
  • RHSA-2026:86891 Released 2026-10-21 · Red Hat rating Critical
    RHOAI 3.5.2 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-cli-rhel9 +47
  • RHSA-2026:84734 Released 2026-10-19 · Red Hat rating Critical
    RHOAI 3.4.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
  • RHSA-2026:83121 Released 2026-10-14 · Red Hat rating Important
    Red Hat AI Inference 3.4.6 (rocm)
    • Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-rocm-rhel9
  • RHSA-2026:83120 Released 2026-10-14 · Red Hat rating Important
    Red Hat AI Inference 3.4.6 (cuda)
    • Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-cuda-rhel9
  • RHSA-2026:83116 Released 2026-10-14 · Red Hat rating Important
    Red Hat AI Inference Model Optimization Tools 3.4.6 (cuda)
    • Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/model-opt-cuda-rhel9
  • RHSA-2026:83114 Released 2026-10-14 · Red Hat rating Important
    Red Hat AI Inference 3.4.6 (spyre)
    • Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-spyre-rhel9
  • RHSA-2026:83112 Released 2026-10-14 · Red Hat rating Important
    Red Hat AI Inference 3.4.6 (cpu)
    • Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-cpu-rhel9
  • RHSA-2026:82371 Released 2026-10-13 · Red Hat rating Critical
    Red Hat AI Inference 3.5.2 (spyre)
    • Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-spyre-rhel9

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Exploit IntelligenceAffectedNo fix yet
Lightspeed CoreAffectedNo fix yet
OpenShift LightspeedAffectedNo fix yet
Red Hat AI Inference ServerAffectedNo fix planned: Will not fix
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix planned: Will not fix
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat Satellite 6AffectedNo fix yet
Red Hat AI Inference Server 3.4Fixed RHSA-2026:83112, RHSA-2026:83114, RHSA-2026:83116, RHSA-2026:83120, RHSA-2026:83121
Red Hat AI Inference Server 3.5Fixed RHSA-2026:82371
Red Hat Ansible Automation Platform 2.6Fixed RHSA-2026:87120
Red Hat Ansible Automation Platform 2.7Fixed RHSA-2026:87124
Red Hat Enterprise Linux AI 3.4Fixed RHSA-2026:90432, RHSA-2026:90440
Red Hat OpenShift AI 2.25Fixed RHSA-2026:87410
Red Hat OpenShift AI 3.4Fixed RHSA-2026:84734, RHSA-2026:92510
Red Hat OpenShift AI 3.5Fixed RHSA-2026:86891, RHSA-2026:94631
Not affected: 7 products
  • Red Hat Ansible Automation Platform 2
  • Red Hat Ansible Automation Platform 2.6
  • Red Hat Ansible Automation Platform 2.7
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.4
  • Red Hat OpenShift AI 3.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-104851
  2. 2026-10-04 Priority changed: MEDIUM → LOW
  3. 2026-10-06 CISA SSVC decision points changed
  4. 2026-10-06 Priority changed: LOW → HIGH
  5. 2026-10-06 Alias added: GHSA-27vj-qcqg-25rc
  6. 2026-10-06 Fix available: PyPI/[email protected] · GHSA-27vj-qcqg-25rc
  7. 2026-10-06 CVSS score added · GHSA-27vj-qcqg-25rc
  8. 2026-10-06 Weakness changed · GHSA-27vj-qcqg-25rc
  9. 2026-10-06 8 new references · GHSA-27vj-qcqg-25rc
  10. 2026-10-06 Affected versions changed · Red Hat
  11. 2026-10-10 Affected versions changed · Red Hat
  12. 2026-10-14 Fix available: RHSA-2026:82371 · Red Hat
  13. 2026-10-16 Fix available: RHSA-2026:83112 · Red Hat
  14. 2026-10-16 Fix available: RHSA-2026:83116 · Red Hat
  15. 2026-10-16 Fix available: RHSA-2026:83114 · Red Hat
  16. 2026-10-16 Fix available: RHSA-2026:83120 · Red Hat
  17. 2026-10-16 Fix available: RHSA-2026:83121 · Red Hat
  18. 2026-10-16 Fix available: Red Hat AI Inference Server 3.4, Red Hat AI Inference Server 3.5 · Red Hat
  19. 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
  20. 2026-10-20 Fix available: Red Hat OpenShift AI 3.4 · Red Hat
  21. 2026-10-22 Fix available: RHSA-2026:87124 · Red Hat
  22. 2026-10-22 Fix available: RHSA-2026:87120 · Red Hat
  23. 2026-10-22 Fix available: RHSA-2026:86891 · Red Hat
  24. 2026-10-22 Fix available: RHSA-2026:87410 · Red Hat
  25. 2026-10-23 Fix available: Red Hat Ansible Automation Platform 2.6, Red Hat Ansible Automation Platform 2.7, Red Hat OpenShift AI 2.25 +1 · Red Hat
  26. 2026-10-29 Fix available: Red Hat Enterprise Linux AI 3.4 · Red Hat
  27. 2026-10-30 Fix available: RHSA-2026:90432 · Red Hat
  28. 2026-10-30 Fix available: RHSA-2026:90440 · Red Hat
  29. 2026-10-30 Fix available: RHSA-2026:92510 · Red Hat
  30. 2026-10-30 Affected versions changed · Red Hat
  31. 2026-10-30 Affected versions changed · Red Hat
  32. 2026-11-04 Fix available: RHSA-2026:94631 · Red Hat
  33. 2026-11-04 Affected versions changed · Red Hat

References

Advisory 1

Other 7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences