Most recent entries from all

BREW-aider-CVE-2026-104851 — fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution

Affected: Homebrew: aider

### Summary

`fsspec.implementations.reference.ReferenceFileSystem` parses a "references" JSON document (Kerchunk format) supplied either inline or via a URL. The parser renders fields from this JSON through **un-sandboxed** `jinja2.Template(...).render(...)` calls in three locations. An attacker who controls the JSON document — typically by hosting it at a URL that the victim opens with `fsspec.filesystem("reference", fo=URL)` or via `xarray.open_dataset("reference://...")` — achieves arbitrary Python code execution on the victim machine, before any data is read.

This mirrors the pattern of [CVE-2024-34359](https://nvd.nist.gov/vuln/detail/CVE-2024-34359) in `llama-cpp-python`, where externally-sourced template strings were rendered with the default unrestricted Jinja2 environment.

### Affected versions

All versions of `fsspec` from `0.9.0` onward (vulnerable code introduced in commit `0fb8d56b684ee74ad9ad4587fd560bde1b116450`, 2021-03-12). Confirmed on the latest released version `2025.10.0`.

### Affected sinks

All in `fsspec/implementations/reference.py`:

| Sink | Location | Trigger | |---|---|---| | A — `_process_references1._render_jinja` | lines 1016-1018 | `simple_templates=False` and a `refs` entry contains `{{` | | B — `_process_templates` (lambda) | lines 1043-1053 | `templates` dict has values containing `{{`, invoked later via render context | | C — `_process_gen` | lines 1075-1083 | references JSON contains a `gen` array (always reached, regardless of `sim…

CLEANSTART-2026-ER50683 — fsspec is a specification and Python implementation framework for filesystem interfaces

Affected: CleanStart: airflow-3

CVE-2026-104851 affects multiple packages. fsspec is a specification and Python implementation framework for filesystem interfaces. See references for individual vulnerability details.

EUVD-2026-382423

fkie_cve-2026-104851

fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0, fsspec.implementations.reference.ReferenceFileSystem evaluates fields from Kerchunk reference JSON documents through unrestricted jinja2.Template(...).render(...) calls in _process_references1._render_jinja, _process_templates, and _process_gen in fsspec/implementations/reference.py. A document supplied inline or fetched from an attacker-controlled URL can provide template expressions that execute Python code when the reference filesystem is opened, including through consumers such as xarray, before referenced data is read. The _process_gen path is reached whenever a document includes a gen array, while the other paths depend on template-related options and values. This issue is fixed in version 2026.6.0.

GHSA-27vj-qcqg-25rc — fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution

Affected: PyPI: fsspec

### Summary

### Affected versions

All versions of `fsspec` from `0.9.0` onward (vulnerable code introduced in commit `0fb8d56b684ee74ad9ad4587fd560bde1b116450`, 2021-03-12). Confirmed on the latest released version `2025.10.0`.

### Affected sinks

All in `fsspec/implementations/reference.py`:

openSUSE-SU-2026:22028-1 — Security update for python-fsspec

Security update for python-fsspec

RHSA-2026:82371 — Red Hat Security Advisory: Red Hat AI Inference 3.5.2 (spyre)

libxml2: Stack Buffer Overflow in xmllint Interactive Shell Command Handling sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filtered_buf pointer in init_unpack() GDBusServer: glib2: GDBusServer pre-authentication DoS via unbounded SASL line buffering xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c Libgcrypt: Libgcrypt: Denial of Service and buffer overflow via crafted ECDH ciphertext urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers urllib3: urllib3: Denial of Service due to excessive HTTP response decompression vim: Vim: Arbitrary Code Execution via crafted directory names vim: Vim: Arbitrary code execution via crafted step-definition patterns vim: Vim: Arbitrary code execution via Python omni-completion acl: Symlink traversal privilege escalation via libacl functions linux-pam: Plaintext password recovery via timing discrepancy in pam_userdb module vim: Vim: Out-of-bounds Write in Spell File Word Count vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo() vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion glib: buffer over…

UBUNTU-CVE-2026-104851

Affected: Ubuntu:20.04:LTS: fsspec, Ubuntu:22.04:LTS: fsspec, Ubuntu:24.04:LTS: fsspec, Ubuntu:26.04:LTS: fsspec