{"id":"CVE-2023-37476","aliases":["DEBIAN-CVE-2023-37476","EUVD-2023-2096","GHSA-m88m-crr9-jvqq","UBUNTU-CVE-2023-37476","USN-7260-1"],"status":"published","title":"Zip slip in OpenRefine","description":"OpenRefine is a free, open source tool for data processing. A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution in the context of the OpenRefine process if a user can be convinced to import it. The vulnerability exists in all versions of OpenRefine up to and including 3.7.3. Users should update to OpenRefine 3.7.4 as soon as possible. Users unable to upgrade should only import OpenRefine projects from trusted sources.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00625,"percentile":0.50432,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2023-07-17T21:02:46Z","modified":"2026-10-28T10:38:48Z","fixes":[{"ecosystem":"Maven","package":"org.openrefine:main","fixed_in":["3.7.4"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"openrefine","fixed_in":["3.6.2-2+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"openrefine","fixed_in":["3.6.2-3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"openrefine","fixed_in":["3.5.2-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"openrefine","fixed_in":["3.7.7-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.openrefine:main","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"openrefine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.2-2+deb12u1"}]}],"versions":["3.6.2-2"]},{"source":"osv","ecosystem":"Debian:13","package":"openrefine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.2-3"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.openrefine:main","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.4"}]}],"versions":["3.6-beta1","3.6-beta2","3.6-rc1","3.6.0","3.6.1","3.6.2","3.7-beta1","3.7-beta2","3.7.0","3.7.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"openrefine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.2-1ubuntu0.1~esm1"}]}],"versions":["3.5.2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"openrefine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.7-1ubuntu0.1~esm1"}]}],"versions":["3.6.2-3","3.7.6-1","3.7.7-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"openrefine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.2-1ubuntu0.1~esm1"}]}],"versions":["3.5.2-1"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"openrefine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.7-1ubuntu0.1~esm1"}]}],"versions":["3.6.2-3","3.7.6-1","3.7.7-1"],"bundled":10}],"products":[{"vendor":"openrefine","product":"openrefine"}],"references":[{"url":"https://github.com/OpenRefine/OpenRefine/security/advisories/GHSA-m88m-crr9-jvqq","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/OpenRefine/OpenRefine/commit/e9c1e65d58b47aec8cd676bd5c07d97b002f205e","tags":["x_refsource_MISC","x_transferred","Patch","fix","web","report"]},{"url":"https://github.com/OpenRefine/OpenRefine/releases/tag/3.7.4","tags":["x_refsource_MISC","web"]},{"url":"https://www.sonarsource.com/blog/openrefine-zip-slip","tags":["x_refsource_MISC","article","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-37476","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-m88m-crr9-jvqq"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37476.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-37476","tags":["advisory"]},{"url":"https://github.com/OpenRefine/OpenRefine","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2023-37476","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-37476","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7260-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-41886","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-41887","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-23833","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47878","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47879","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47880","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47881","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47882","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49760","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-37476","title":"Zip slip in OpenRefine","description":"OpenRefine is a free, open source tool for data processing. A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution in the context of the OpenRefine process if a user can be convinced to import it. The vulnerability exists in all versions of OpenRefine up to and including 3.7.3. Users should update to OpenRefine 3.7.4 as soon as possible. Users unable to upgrade should only import OpenRefine projects from trusted sources.","status":"published","published":"2023-07-17T21:02:46.588Z","modified":"2025-06-10T15:30:33.285Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:35:16.126506Z"}],"euvd":[{"id":"EUVD-2023-2096","description":"OpenRefine is a free, open source tool for data processing. A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution in the context of the OpenRefine process if a user can be convinced to import it. The vulnerability exists in all versions of OpenRefine up to and including 3.7.3. Users should update to OpenRefine 3.7.4 as soon as possible. Users unable to upgrade should only import OpenRefine projects from trusted sources.","status":"published","published":"2023-07-17T21:02:46Z","modified":"2025-06-10T15:30:33Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T20:32:26.841647Z"}],"ghsa":[{"id":"GHSA-m88m-crr9-jvqq","title":"OpenRefine vulnerable to zip slip in project import","description":"### Impact\n\nA carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution if a user can be convinced to import it.\n\n### Patches\n\nThe vulnerability exists in all versions of OpenRefine up to and including 3.7.3. Users should update to OpenRefine 3.7.4 as soon as possible.\n\n### Workarounds\n\nOnly import OpenRefine projects from trusted sources.\n\n### References\n\nA similar [issue](https://github.com/OpenRefine/OpenRefine/issues/1840) existed in the Create Project feature ([CVE-2018-19859](https://nvd.nist.gov/vuln/detail/CVE-2018-19859)), which was fixed by PR [#1901](https://github.com/OpenRefine/OpenRefine/pull/1901).","status":"published","published":"2023-07-18T18:47:27Z","modified":"2025-06-10T15:30:41Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:38:46.901955Z"}],"nvd":[{"id":"CVE-2023-37476","description":"OpenRefine is a free, open source tool for data processing. A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution in the context of the OpenRefine process if a user can be convinced to import it. The vulnerability exists in all versions of OpenRefine up to and including 3.7.3. Users should update to OpenRefine 3.7.4 as soon as possible. Users unable to upgrade should only import OpenRefine projects from trusted sources.","status":"published","published":"2023-07-17T22:15:09.45Z","modified":"2026-06-17T06:08:17.75Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:08:17.044696Z"}],"osv":[{"id":"CVE-2023-37476","title":"Zip slip in OpenRefine","description":"OpenRefine is a free, open source tool for data processing. A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution in the context of the OpenRefine process if a user can be convinced to import it. The vulnerability exists in all versions of OpenRefine up to and including 3.7.3. Users should update to OpenRefine 3.7.4 as soon as possible. Users unable to upgrade should only import OpenRefine projects from trusted sources.","status":"published","published":"2023-07-17T21:02:46.588Z","modified":"2026-10-28T10:38:48.297465336Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:44:32.510144Z"},{"id":"DEBIAN-CVE-2023-37476","description":"OpenRefine is a free, open source tool for data processing. A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution in the context of the OpenRefine process if a user can be convinced to import it. The vulnerability exists in all versions of OpenRefine up to and including 3.7.3. Users should update to OpenRefine 3.7.4 as soon as possible. Users unable to upgrade should only import OpenRefine projects from trusted sources.","status":"published","published":"2023-07-17T22:15:09.45Z","modified":"2026-10-26T18:02:29.890992443Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:39.980321Z"},{"id":"GHSA-m88m-crr9-jvqq","title":"OpenRefine vulnerable to zip slip in project import","description":"### Impact\n\nA carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution if a user can be convinced to import it.\n\n### Patches\n\nThe vulnerability exists in all versions of OpenRefine up to and including 3.7.3. Users should update to OpenRefine 3.7.4 as soon as possible.\n\n### Workarounds\n\nOnly import OpenRefine projects from trusted sources.\n\n### References\n\nA similar [issue](https://github.com/OpenRefine/OpenRefine/issues/1840) existed in the Create Project feature ([CVE-2018-19859](https://nvd.nist.gov/vuln/detail/CVE-2018-19859)), which was fixed by PR [#1901](https://github.com/OpenRefine/OpenRefine/pull/1901).","status":"published","published":"2023-07-18T18:47:27Z","modified":"2026-09-10T03:49:42.616702686Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:51.463834Z"},{"id":"UBUNTU-CVE-2023-37476","description":"OpenRefine is a free, open source tool for data processing. A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution in the context of the OpenRefine process if a user can be convinced to import it. The vulnerability exists in all versions of OpenRefine up to and including 3.7.3. Users should update to OpenRefine 3.7.4 as soon as possible. Users unable to upgrade should only import OpenRefine projects from trusted sources.","status":"published","published":"2023-07-17T22:15:00Z","modified":"2026-02-04T02:23:04.069415Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:21.882004Z"},{"id":"USN-7260-1","title":"openrefine vulnerabilities","description":"It was discovered that OpenRefine did not properly handle opening tar\nfiles. If a user or application were tricked into opening a crafted tar\nfile, an attacker could possibly use this issue to execute arbitrary code.\nThis issue only affected Ubuntu 22.04 LTS. (CVE-2023-37476)\n\nIt was discovered that OpenRefine incorrectly handled file permissions and\nuser authentication. An unauthenticated attacker could possibly use this\nissue to leak sensitive information or execute arbitrary code. This issue\nonly affected Ubuntu 22.04 LTS. (CVE-2023-41886, CVE-2023-41887)\n\nIt was discovered that OpenRefine did not properly disallow database\nsettings to be modified when queried. An attacker could possibly use this\nissue to leak sensitive information. This issue only affected\nUbuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-23833)\n\nIt was discovered that OpenRefine did not properly sanitize the GET\nparameter for authorized commands, leading to a cross site scripting\nvulnerability. An attacker could possibly use this issue to execute\narbitrary code. (CVE-2024-47878)\n\nIt was discovered that OpenRefine did not properly prevent cross-site\nrequest forgery when running the preview-expression command. If a user or\napplication were tricked into opening a specially crafted webpage, an\nattacker could possibly use this issue to execute arbitrary code.\n(CVE-2024-47879)\n\nIt was discovered that OpenRefine did not properly handle HTTP headers.\nAn attacker could possibly use this issue to execute arbitrary code.\n(CVE-2024-47880)\n\nIt was discovered that OpenRefine incorrectly handled database extensions.\nAn attacker could possibly use this issue to execute arbitrary code.\n(CVE-2024-47881)\n\nIt was discovered that OpenRefine did not properly escape HTML tags in\nexception messages, which could enable code injection. If a user or\napplication were tricked into opening a malicious file, an attacker could\nuse this issue to execute arbitrary code. (CVE-2024-47882)\n\nIt was discovered that OpenRefine did not correctly handle paths when\nexecuting the load-language command. An attacker could possibly use this\nissue to leak sensitive information. (CVE-2024-49760)\n","status":"published","published":"2025-02-10T03:32:44Z","modified":"2026-04-27T17:43:15.654565Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}