org.openrefine.dependencies vulnerabilities

Products

• org.openrefine.dependencies/butterfly 2

Latest org.openrefine.dependencies CVEs

Newest publication first

1. CVE-2024-47883 Butterfly has path/URL confusion in resource handling leading to multiple weaknesses

   Published 2024-10-24

   Critical·CVSS 9.1 EPSS 1.6%

   The OpenRefine fork of the MIT Simile Butterfly server is a modular web application framework. The Butterfly framework uses the java.net.URL class to refer to (what are expected to be) local resource files, like images or templates. This works: "opening a connection" to these URL...

2. GHSA-mpcw-3j5p-p99x Butterfly's parseJSON, getJSON functions eval malicious input, leading to remote code execution (RCE)

   Published 2024-10-24

   Unknown

   Summary Usage of the Butterfly.prototype.parseJSON or getJSON functions on an attacker-controlled crafted input string allows the attacker to execute arbitrary JavaScript code on the server. Since Butterfly JavaScript code has access to Java classes, it can run arbitrary programs...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.