Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

OpenRefine — Vulnerabilities & Security Advisories 11

Browse all 11 CVE security advisories affecting OpenRefine. AI-powered Chinese analysis, POCs, and references for each vulnerability.

OpenRefine serves as a powerful tool for cleaning and transforming messy data, enabling users to explore and refine datasets through an interactive interface. Historically, it has been susceptible to multiple remote code execution vulnerabilities, cross-site scripting flaws, and privilege escalation issues, with 11 CVEs documented to date. The application's web-based nature and data processing capabilities have made it a target for security researchers, though no major public incidents have been widely reported. Users should remain vigilant about input validation and access controls when deploying this tool in production environments, as its data manipulation features could be exploited if proper security measures are not implemented.

Top products by OpenRefine: OpenRefine simile-butterfly
CVE ID Title CVSS Severity Published
CVE-2024-49760 OpenRefine has a path traversal in LoadLanguageCommand — OpenRefine CWE-22 7.1 High 2024-10-24
CVE-2024-47883 Butterfly has path/URL confusion in resource handling leading to multiple weaknesses — simile-butterfly CWE-36 9.1 Critical 2024-10-24
CVE-2024-47882 OpenRefine's error page lacks escaping, leading to potential Cross-site Scripting on import of malicious project — OpenRefine CWE-79 5.9 Medium 2024-10-24
CVE-2024-47881 OpenRefine's SQLite integration allows filesystem access, remote code execution (RCE) — OpenRefine CWE-89 8.1 High 2024-10-24
CVE-2024-47880 OpenRefine has a reflected cross-site scripting vulnerability from POST request in ExportRowsCommand — OpenRefine CWE-79 8.1 High 2024-10-24
CVE-2024-47879 OpenRefine's PreviewExpressionCommand, which is eval, lacks protection against cross-site request forgery (CSRF) — OpenRefine CWE-352 7.6 High 2024-10-24
CVE-2024-47878 Reflected cross-site scripting vulnerability (XSS) in GData extension (authorized.vt) — OpenRefine CWE-79 8.1 High 2024-10-24
CVE-2024-23833 OpenRefine JDBC Attack Vulnerability — OpenRefine CWE-22 7.5 High 2024-02-12
CVE-2023-41887 Remote Code exec in project import with mysql jdbc url attack — OpenRefine CWE-89 9.8 Critical 2023-09-15
CVE-2023-41886 OpenRefine vulnerable to arbitrary file read in project import with mysql jdbc url attack — OpenRefine CWE-89 7.5 High 2023-09-15
CVE-2023-37476 Zip slip in OpenRefine — OpenRefine CWE-22 5.5 Medium 2023-07-17

This page lists every published CVE security advisory associated with OpenRefine. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.