fsspec: Server

Advisories.Gitlab • October 6, 2026

fsspec.implementations.reference.ReferenceFileSystem parses a “references” JSON document (Kerchunk format) supplied either inline or via a URL. The parser renders fields from this JSON through un-sandboxed jinja2.Template(...).render(...) calls in three locations. An attacker who controls the JSON document — typically by hosting it at a URL that the victim opens with fsspec.filesystem("reference", fo=URL) or via xarray.open_dataset("reference://...") — achieves arbitrary Python code execution on the victim machine, before any data is read.

This mirrors the pattern of CVE-2024-34359 in llama-cpp-python , where externally-sourced template strings were rendered with the default unrestricted Jinja2 environment.

github.com /advisories/GHSA-27vj-qcqg-25rc

github.com /fsspec/filesystem_spec/commit/86438783f93b1398ef245b92f0e6063b445b611c

github.com /fsspec/filesystem_spec/commit/a1c16ab3f07f354aa371c38f7b1b07ea7fd4c5c8

github.com /fsspec/filesystem_spec/pull/2029

github.com /fsspec/filesystem_spec/pull/2039

github.com /fsspec/filesystem_spec/releases/tag/2026.6.0

github.com /fsspec/filesystem_spec/security/advisories/GHSA-27vj-qcqg-25rc

nvd.nist.gov /vuln/detail/CVE-2026-104851

Code Behaviors & Features

Detect and mitigate CVE-2026-104851 with GitLab Dependency Scanning

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

fsspec Vulnerability Allows Remote Code Execution via JSON Parsing A vulnerability (CVE-2026-104851) in fsspec's ReferenceFileSystem allows attackers to execute arbitrary Python code by manipulating a JSON document. This flaw affects all versions of fsspec from 0.9.0 onward, with the vulnerable code introduced in March 2021. Attackers can exploit this vulnerability by hosting a malicious JSON document that victims access through fsspec.filesystem or xarray.open_dataset. The issue mirrors a previous vulnerability (CVE-2024-34359) in llama-cpp-python, where un-sandboxed Jinja2 template rendering was also exploited. The vulnerability was published on October 2, 2026, and has a CVSS score of 8.8, indicating a high severity. Users are advised to mitigate the risk by updating to the latest version of fsspec. No evidence of has been reported yet. 1 sources 63

Extracted Entities

fsspec: Server

The full story

Extracted Entities

Attack Types (1)

CVEs (2)

CWE Weaknesses (1)

Domains (1)

MITRE ATT&CK (1)

SHA1 Hashes (2)

Tools (2)