OpenRefine vulnerable to zip slip in project import

CAO 7.8CVE-2023-37476 · GHSA-m88m-crr9-jvqq · Công bố 17/07/2023 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2023-37476 là lỗ hổng mức CAO (CVSS 7.8) ảnh hưởng org.openrefine:main, openrefine (openrefine).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.63%, cao hơn 50.0% các lỗ hổng khác.
Cách xử lý: cập nhật lên 3.7.4 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
org.openrefine:main Maven	`< 3.7.4`	`3.7.4`
openrefine openrefine	`≤ 3.7.3`	Chưa có bản vá

Mô tả

Impact

A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution if a user can be convinced to import it.

Patches

The vulnerability exists in all versions of OpenRefine up to and including 3.7.3. Users should update to OpenRefine 3.7.4 as soon as possible.

Workarounds

Only import OpenRefine projects from trusted sources.

References

A similar issue existed in the Create Project feature (CVE-2018-19859), which was fixed by PR #1901.

Mô tả của NVD

OpenRefine is a free, open source tool for data processing. A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution in the context of the OpenRefine process if a user can be convinced to import it. The vulnerability exists in all versions of OpenRefine up to and including 3.7.3. Users should update to OpenRefine 3.7.4 as soon as possible. Users unable to upgrade should only import OpenRefine projects from trusted sources.