{"id":"CVE-2026-104851","title":"fsspec is a specification and Python implementation framework for filesystem interfaces","summary":"fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0, fsspec.implementations.reference.ReferenceFileSystem evaluates fields from Kerchunk reference JSON documents through unre…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":["CWE-94","CWE-1336"],"vendor":"fsspec","product":"filesystem_spec","affected":["filesystem_spec >= 0.9.0, < 2026.6.0"],"published":"2026-10-02","updated":"2026-10-05","sourceUpdated":"2026-10-05T20:17:09.373","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104851","references":[{"url":"https://github.com/fsspec/filesystem_spec/commit/86438783f93b1398ef245b92f0e6063b445b611c","label":"security-advisories@github.com"},{"url":"https://github.com/fsspec/filesystem_spec/commit/a1c16ab3f07f354aa371c38f7b1b07ea7fd4c5c8","label":"security-advisories@github.com"},{"url":"https://github.com/fsspec/filesystem_spec/pull/2029","label":"security-advisories@github.com"},{"url":"https://github.com/fsspec/filesystem_spec/pull/2039","label":"security-advisories@github.com"},{"url":"https://github.com/fsspec/filesystem_spec/releases/tag/2026.6.0","label":"security-advisories@github.com"},{"url":"https://github.com/fsspec/filesystem_spec/security/advisories/GHSA-27vj-qcqg-25rc","label":"security-advisories@github.com"},{"url":"https://github.com/fsspec/filesystem_spec/security/advisories/GHSA-27vj-qcqg-25rc","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-104851.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-104851"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2545294"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-104851"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104851"},{"url":"https://github.com/advisories/GHSA-27vj-qcqg-25rc"},{"url":"https://github.com/fsspec/filesystem_spec"},{"url":"https://access.redhat.com/errata/RHSA-2026:82371"},{"url":"https://access.redhat.com/errata/RHSA-2026:83116"},{"url":"https://access.redhat.com/errata/RHSA-2026:83112"},{"url":"https://access.redhat.com/errata/RHSA-2026:83120"},{"url":"https://access.redhat.com/errata/RHSA-2026:83121"},{"url":"https://access.redhat.com/errata/RHSA-2026:83114"},{"url":"https://pypi.org/project/fsspec"},{"url":"https://access.redhat.com/errata/RHSA-2026:84734"}],"tags":["nvd","cve.org","exploit-available","csaf","vex","red-hat","ghsa","pip","osv"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-10-05T20:03:10.746838Z"},"epss":0.00475,"epssPercentile":0.4085,"ingestedAt":"2026-10-02T17:24:03.905Z","aliases":["GHSA-27vj-qcqg-25rc","PYSEC-2026-4217"],"ecosystem":"pip","patched":["fsspec 2026.6.0"],"slug":"CVE-2026-104851","body":"## Overview\n\nfsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0, fsspec.implementations.reference.ReferenceFileSystem evaluates fields from Kerchunk reference JSON documents through unrestricted jinja2.Template(...).render(...) calls in _process_references1._render_jinja, _process_templates, and _process_gen in fsspec/implementations/reference.py. A document supplied inline or fetched from an attacker-controlled URL can provide template expressions that execute Python code when the reference filesystem is opened, including through consumers such as xarray, before referenced data is read. The _process_gen path is reached whenever a document includes a gen array, while the other paths depend on template-related options and values. This issue is fixed in version 2026.6.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Exploit Intelligence, Lightspeed Core, OpenShift Lightspeed, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI) 3, … · no fix planned: Red Hat AI Inference Server, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), Exploit Intelligence, … · updated 2026-10-19 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-104851.json)\n- **RHSA-2026:82371** · Red Hat · fixed in: Red Hat AI Inference Server 3.5 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82371)\n- **RHSA-2026:83116** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-10-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:83116)\n- **RHSA-2026:83112** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-10-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:83112)\n- **RHSA-2026:83120** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-10-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:83120)\n- **RHSA-2026:83121** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-10-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:83121)\n- **RHSA-2026:83114** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-10-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:83114)\n- **RHSA-2026:84734** · Red Hat · fixed in: Red Hat OpenShift AI 3.4 · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:84734)\n\n## Package advisory (CVE-2026-104851)\n\nAffected packages:\n\n- `fsspec >= 0.9.0, < 2026.6.0`\n\nPatched in:\n\n- `fsspec 2026.6.0`\n\nSource: https://github.com/advisories/GHSA-27vj-qcqg-25rc","depth":"midnight","depthScore":60,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":216049,"id":"CVE-2026-104851","ts":1791232418269,"field":"exploit_available","old":"false","new":"true"}]}