Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

fsspec

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.8PyPIAmendedPublished

    fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution

    CVE-2026-104851 · GHSA-27vj-qcqg-25rc

    Affected
    • PyPI fsspec >= 0.9.0, < 2026.6.0
    Fixed in
    2026.6.0· Vendor fix available
    Issue
    fsspec.implementations.reference.ReferenceFileSystem parses a "references" JSON document (Kerchunk format) supplied either inline or via a URL. The parser renders fields from this JSON through un-sandboxed jinja2.Template(...).render(...) calls in three locations. An attacker who controls the JSON document — typically by hosting it at a URL that the victim opens with fsspec.filesystem("reference", fo=URL) or via xarray.opendataset("reference://...") — achieves arbitrary Python code execution on the victim machine, before any data is read. This mirrors the pattern of CVE-2024-34359 in llama-cpp-python, where externally-sourced template strings were rendered with the default unrestricted Jinja2 environment. Affected versions All versions of fsspec from 0.9.0 onward (vulnerable code introduced in commit 0fb8d56b684ee74ad9ad4587fd560bde1b116450, 2021-03-12). Confirmed on the latest released version 2025.10.0. Affected sinks All in fsspec/implementations/reference.py: | Sink |…

    Recommended action: Upgrade to 2026.6.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.com (1)osv.dev (2)Source checked Evidence →