debian/fsspec vulnerabilities

Latest debian/fsspec CVEs

Newest publication first

1. CVE-2026-104851 fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution

   Published 2026-10-02

   High·CVSS 8.8 EPSS 0.48%

   fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0, fsspec.implementations.reference.ReferenceFileSystem evaluates fields from Kerchunk reference JSON documents through unrestricted jinja2.Template(...).render(...) c...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.