fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution

Summaryfsspec.implementations.reference.ReferenceFileSystem parses a "references"JSON document Kerchunk format supplied either inline or via a URL. Theparser renders fields from this JSON through un-sandboxedjinja2.Template....render... calls in three locations. An attacker whocontrols the JSON...

PYSEC-2026-4217 fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution

Summary fsspec.implementations.reference.ReferenceFileSystem parses a "references" JSON document Kerchunk format supplied either inline or via a URL. The parser renders fields from this JSON through un-sandboxed jinja2.Template....render... calls in three locations. An attacker who controls the...

ROOT-APP-PYPI-CVE-2026-104851 CVE-2026-104851 in fsspec - Patched by Root

Root has patched CVE-2026-104851 in the fsspec package for Root:PyPI. Multiple fixed versions available...

CLEANSTART-2026-ER50683 fsspec is a specification and Python implementation framework for filesystem interfaces

CVE-2026-104851 affects multiple packages. fsspec is a specification and Python implementation framework for filesystem interfaces. See references for individual vulnerability details...

openSUSE 16 Security Update : python-fsspec (openSUSE-SU-2026:22028-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:22028-1 advisory. Changes in python-fsspec: - CVE-2026-104851: python-fsspec: remote code execution via server-side template injection in ReferenceFileSystem bsc1284173...

Security update for python-fsspec (important)

openSUSE security update: security update for python-fsspec ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22028-1 Rating: important References: bsc1284173 Cross-References: CVE-2026-104851 Affected Products: openSUSE Leap 16.0...

OPENSUSE-SU-2026:22028-1 Security update for python-fsspec

This update for python-fsspec fixes the following issues: Changes in python-fsspec: - CVE-2026-104851: python-fsspec: remote code execution via server-side template injection in ReferenceFileSystem bsc1284173...

GHSA-27VJ-QCQG-25RC fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution

Summary fsspec.implementations.reference.ReferenceFileSystem parses a "references" JSON document Kerchunk format supplied either inline or via a URL. The parser renders fields from this JSON through un-sandboxed jinja2.Template....render... calls in three locations. An attacker who controls the...

3lc (>=2.3.84, <=2.22.0), 3lc-ultralytics (>=0.1.0, <=0.2.1) +2572 more potentially affected by CVE-2026-104851 via fsspec (>=0.9.0, <=2026.4.0)

fsspec PYPI version =0.9.0, =2.3.84, =0.1.0, =0.3.2, =1.1.0, =0.1.0, =0.2.1, =0.1.3, =2.0.0, =0.1.0, =0.0.5a0, =1.3.0, =1.4.1 and more Source cves: CVE-2026-104851 Source advisory: GHSA-27VJ-QCQG-25RC...

EUVD-2026-91720

fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution...

3lc (>=2.3.84, <=2.22.0), 3lc-ultralytics (>=0.1.0, <=0.2.1) +2572 more potentially affected by CVE-2026-104851 via fsspec (>=0.9.0, <=2026.4.0)

fsspec PYPI version =0.9.0, =2.3.84, =0.1.0, =0.3.2, =1.1.0, =0.1.0, =0.2.1, =0.1.3, =2.0.0, =0.1.0, =0.0.5a0, =1.3.0, =1.4.1 and more Source cves: CVE-2026-104851 Source advisory: OSV:GHSA-27VJ-QCQG-25RC...

fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution

Summary fsspec.implementations.reference.ReferenceFileSystem parses a "references" JSON document Kerchunk format supplied either inline or via a URL. The parser renders fields from this JSON through un-sandboxed jinja2.Template....render... calls in three locations. An attacker who controls the...

Linux Distros Unpatched Vulnerability : CVE-2026-104851

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0,...

CVE-2026-104851

A flaw was found in fsspec. This vulnerability can lead to arbitrary code execution due to unrestricted template evaluation in the ReferenceFileSystem component. When processing filesystem reference metadata documents, template expressions are evaluated without security restrictions or sandboxing...

CVE-2026-104851

fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0, fsspec.implementations.reference.ReferenceFileSystem evaluates fields from Kerchunk reference JSON documents through unrestricted jinja2.Template....render... calls in...

DEBIAN-CVE-2026-104851

fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0, fsspec.implementations.reference.ReferenceFileSystem evaluates fields from Kerchunk reference JSON documents through unrestricted jinja2.Template....render... calls in...

UBUNTU-CVE-2026-104851

fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0, fsspec.implementations.reference.ReferenceFileSystem evaluates fields from Kerchunk reference JSON documents through unrestricted jinja2.Template....render... calls in...

CVE-2026-104851

fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0, fsspec.implementations.reference.ReferenceFileSystem evaluates fields from Kerchunk reference JSON documents through unrestricted jinja2.Template....render... calls in...

CVE-2026-104851 fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution

fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0, fsspec.implementations.reference.ReferenceFileSystem evaluates fields from Kerchunk reference JSON documents through unrestricted jinja2.Template....render... calls in...

CVE-2026-104851 fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution

fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0, fsspec.implementations.reference.ReferenceFileSystem evaluates fields from Kerchunk reference JSON documents through unrestricted jinja2.Template....render... calls in...