org.openrefine/extensions vulnerabilities

Latest org.openrefine/extensions CVEs

Newest publication first

1. CVE-2024-47878 Reflected cross-site scripting vulnerability (XSS) in GData extension (authorized.vt)

   Published 2024-10-24

   Medium·CVSS 6.1 EPSS 0.46%

   OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the /extension/gdata/authorized endpoint includes the state GET parameter verbatim in a <script> tag in the output, so without escaping. An attacker could lead or redirect a user to a craf...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.