4 results · Feed
-
High 7.1
OpenRefine has a path traversal in LoadLanguageCommand
OpenRefine is a free, open source tool for working with messy data. The load-language command expects a `lang` parameter from which it constructs the path of the localization file to load, of the form `translations-$LANG.json`. But when doing so in versions p…
-
Medium 5.9
OpenRefine's error page lacks escaping, leading to potential Cross-site Scripting on import of malicious project
OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the built-in "Something went wrong!" error page includes the exception message and exception traceback without escaping HTML tags, enabling injection into the page if …
-
High 8.1
OpenRefine has a reflected cross-site scripting vulnerability from POST request in ExportRowsCommand
OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the `export-rows` command can be used in such a way that it reflects part of the request verbatim, with a Content-Type header also taken from the request. An attacker …
-
High —
OpenRefine leaks Google API credentials in releases
### Impact OpenRefine releases contain Google API authentication keys ("client id" and "client secret") which can be extracted from released artifacts. For instance, download the package for OpenRefine 3.8.2 on linux. It contains the file `openrefine-3.8.2/we…