{"metadata": {"vulnerability": "CVE-2026-108553", "count": 15, "kinds": {"milestone": 5, "sighting": 3, "kev": 0, "other": 7}}, "data": [{"timestamp": "2026-10-01T00:00:00Z", "date_only": false, "value": "2026-10-01T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-108553", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-10T14:39:40.008Z", "date_only": false, "value": "2026-10-10T14:39:40.008Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-108553", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-10T14:49:38.768Z", "date_only": false, "value": "2026-10-10T14:49:38.768Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-108553", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-10T14:49:38.768Z", "date_only": false, "value": "2026-10-10T14:49:38.768Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-108553", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-10T14:49:38.768Z", "date_only": false, "value": "2026-10-10T14:49:38.768Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-108553", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-10T14:53:45.199Z", "date_only": false, "value": "2026-10-10T14:53:45.199296Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117417182801773432", "record": "CVE-2026-108553", "field": "creation_timestamp", "uuid": "8408c375-4293-47d7-913c-bc2bd047b8c1", "content": "CVE-2026-108553 OpenRefine through 3.10.1 CSRF to RCE via get-rows Command OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, executing operating system commands as the OpenRefine user.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108553https://github.com/OpenRefine/OpenRefine/issues/7999https://github.com/OpenRefine/OpenRefinehttps://github.com/OpenRefine/OpenRefine/blob/bde8a36dc188f7846aeafc2910969e7d0fbc8e7c/main/src/com/google/refine/commands/row/GetRowsCommand.java#L174-L186https://github.com/OpenRefine/OpenRefine/blob/bde8a36dc188f7846aeafc2910969e7d0fbc8e7c/modules/core/src/main/java/com/google/refine/browsing/facets/ListFacet.java#L327-L339https://github.com/OpenRefine/OpenRefine/blob/bde8a36dc188f7846aeafc2910969e7d0fbc8e7c/extensions/jython/src/com/google/refine/jython/JythonEvaluable.java#L142https://www.vulncheck.com/advisories/openrefine-through-3.10.1-csrf-to-rce-via-get-rows-command#OpenRefine#CVE_2026_108553#bot", "url": "https://infosec.exchange/users/cve/statuses/117417182801773432"}, {"timestamp": "2026-10-10T15:16:58Z", "date_only": false, "value": "2026-10-10T15:16:58Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-3FGG-HMV4-HP49", "record": "GHSA-3FGG-HMV4-HP49", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-10T15:16:58.410Z", "date_only": false, "value": "2026-10-10T15:16:58.410", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-108553", "record": "FKIE_CVE-2026-108553", "field": "published"}, {"timestamp": "2026-10-10T15:16:58.410Z", "date_only": false, "value": "2026-10-10T15:16:58.410", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-108553", "record": "FKIE_CVE-2026-108553", "field": "lastModified"}, {"timestamp": "2026-10-10T15:30:23Z", "date_only": false, "value": "2026-10-10T15:30:23Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-3FGG-HMV4-HP49", "record": "GHSA-3FGG-HMV4-HP49", "field": "published"}, {"timestamp": "2026-10-10T15:30:23Z", "date_only": false, "value": "2026-10-10T15:30:23Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-3FGG-HMV4-HP49", "record": "GHSA-3FGG-HMV4-HP49", "field": "modified"}, {"timestamp": "2026-10-10T17:45:57.963Z", "date_only": false, "value": "2026-10-10T17:45:57.963045Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxk26rpptw2e", "record": "CVE-2026-108553", "field": "creation_timestamp", "uuid": "fa04b1a3-bccf-49e2-a02b-5d79944a0b27", "content": "\ud83d\udfe0 CVE-2026-108553 - High (7.5)\n\nOpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows com...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-108553/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxk26rpptw2e"}, {"timestamp": "2026-10-11T03:40:05.118Z", "date_only": false, "value": "2026-10-11T03:40:05.118373Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxl3f6bpos22", "record": "CVE-2026-108553", "field": "creation_timestamp", "uuid": "260a49db-b308-4280-851d-e3c686ee7f29", "content": "CVE-2026-108553 - openrefine\nThe OpenRefine tool (versions up to 3.10.1) can be tricked into running system commands if a logged\u2011in user clicks a specially crafted link on another website. An attacker\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#openrefine #Debian12 #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxl3f6bpos22"}, {"timestamp": "2026-10-12T00:00:00Z", "date_only": false, "value": "2026-10-12T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-108553", "record": "UBUNTU-CVE-2026-108553", "field": "published"}, {"timestamp": "2026-10-13T12:11:44Z", "date_only": false, "value": "2026-10-13T12:11:44Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-108553", "record": "UBUNTU-CVE-2026-108553", "field": "modified"}]}