--- id: CVE-2026-104851 title: >- fsspec is a specification and Python implementation framework for filesystem interfaces summary: >- fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0, fsspec.implementations.reference.ReferenceFileSystem evaluates fields from Kerchunk reference JSON documents through unre… severity: high cvss: 8.8 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H' cwe: - CWE-94 - CWE-1336 vendor: fsspec product: filesystem_spec affected: - 'filesystem_spec >= 0.9.0, < 2026.6.0' published: '2026-10-02' updated: '2026-10-05' sourceUpdated: '2026-10-05T20:17:09.373' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-104851' references: - url: >- https://github.com/fsspec/filesystem_spec/commit/86438783f93b1398ef245b92f0e6063b445b611c label: security-advisories@github.com - url: >- https://github.com/fsspec/filesystem_spec/commit/a1c16ab3f07f354aa371c38f7b1b07ea7fd4c5c8 label: security-advisories@github.com - url: 'https://github.com/fsspec/filesystem_spec/pull/2029' label: security-advisories@github.com - url: 'https://github.com/fsspec/filesystem_spec/pull/2039' label: security-advisories@github.com - url: 'https://github.com/fsspec/filesystem_spec/releases/tag/2026.6.0' label: security-advisories@github.com - url: >- https://github.com/fsspec/filesystem_spec/security/advisories/GHSA-27vj-qcqg-25rc label: security-advisories@github.com - url: >- https://github.com/fsspec/filesystem_spec/security/advisories/GHSA-27vj-qcqg-25rc label: 134c704f-9b21-4f2e-91b3-4a467353bcc0 - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-104851.json - url: 'https://access.redhat.com/security/cve/CVE-2026-104851' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2545294' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-104851' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-104851' - url: 'https://github.com/advisories/GHSA-27vj-qcqg-25rc' - url: 'https://github.com/fsspec/filesystem_spec' - url: 'https://access.redhat.com/errata/RHSA-2026:82371' - url: 'https://access.redhat.com/errata/RHSA-2026:83116' - url: 'https://access.redhat.com/errata/RHSA-2026:83112' - url: 'https://access.redhat.com/errata/RHSA-2026:83120' - url: 'https://access.redhat.com/errata/RHSA-2026:83121' - url: 'https://access.redhat.com/errata/RHSA-2026:83114' - url: 'https://pypi.org/project/fsspec' - url: 'https://access.redhat.com/errata/RHSA-2026:84734' tags: - nvd - cve.org - exploit-available - csaf - vex - red-hat - ghsa - pip - osv exploitAvailable: true ssvc: exploitation: poc automatable: 'no' technicalImpact: total timestamp: '2026-10-05T20:03:10.746838Z' epss: 0.00475 epssPercentile: 0.4085 ingestedAt: '2026-10-02T17:24:03.905Z' aliases: - GHSA-27vj-qcqg-25rc - PYSEC-2026-4217 ecosystem: pip patched: - fsspec 2026.6.0 --- ## Overview fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0, fsspec.implementations.reference.ReferenceFileSystem evaluates fields from Kerchunk reference JSON documents through unrestricted jinja2.Template(...).render(...) calls in _process_references1._render_jinja, _process_templates, and _process_gen in fsspec/implementations/reference.py. A document supplied inline or fetched from an attacker-controlled URL can provide template expressions that execute Python code when the reference filesystem is opened, including through consumers such as xarray, before referenced data is read. The _process_gen path is reached whenever a document includes a gen array, while the other paths depend on template-related options and values. This issue is fixed in version 2026.6.0. ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Vendor advisories - **Red Hat VEX** · Important · affected: Exploit Intelligence, Lightspeed Core, OpenShift Lightspeed, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI) 3, … · no fix planned: Red Hat AI Inference Server, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), Exploit Intelligence, … · updated 2026-10-19 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-104851.json) - **RHSA-2026:82371** · Red Hat · fixed in: Red Hat AI Inference Server 3.5 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82371) - **RHSA-2026:83116** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-10-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:83116) - **RHSA-2026:83112** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-10-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:83112) - **RHSA-2026:83120** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-10-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:83120) - **RHSA-2026:83121** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-10-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:83121) - **RHSA-2026:83114** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-10-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:83114) - **RHSA-2026:84734** · Red Hat · fixed in: Red Hat OpenShift AI 3.4 · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:84734) ## Package advisory (CVE-2026-104851) Affected packages: - `fsspec >= 0.9.0, < 2026.6.0` Patched in: - `fsspec 2026.6.0` Source: https://github.com/advisories/GHSA-27vj-qcqg-25rc