CVE-2026-104851
2 advisories.
PyPI/fsspec CVE-2026-104851: high 8.8, EPSS 0.32%
fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution
Action: Upgrade fsspec to 2026.6.0 or later.
pip install fsspec==2026.6.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.9.0 | 2026.6.0 | - |
Fixed versions
| 2026.6.0 |
Sources
- osv: GHSA-27vj-qcqg-25rc
- https://github.com/fsspec/filesystem_spec/security/advisories/GHSA-27vj-qcqg-25rc
- https://nvd.nist.gov/vuln/detail/CVE-2026-104851
- https://github.com/fsspec/filesystem_spec/pull/2029
- https://github.com/fsspec/filesystem_spec/pull/2039
- https://github.com/fsspec/filesystem_spec/commit/86438783f93b1398ef245b92f0e6063b445b611c
- https://github.com/fsspec/filesystem_spec/commit/a1c16ab3f07f354aa371c38f7b1b07ea7fd4c5c8
- https://github.com/fsspec/filesystem_spec
- https://github.com/fsspec/filesystem_spec/releases/tag/2026.6.0
CVE-2026-104851 · published · modified · JSON
PyPI/fsspec CVE-2026-104851: high 8.8, EPSS 0.32%
fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution
Action: Upgrade fsspec to 2026.6.0 or later.
pip install fsspec==2026.6.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.9.0 | 2026.6.0 | - |
Fixed versions
| 2026.6.0 |
Sources
- osv: PYSEC-2026-4217
- https://github.com/fsspec/filesystem_spec/security/advisories/GHSA-27vj-qcqg-25rc
- https://nvd.nist.gov/vuln/detail/CVE-2026-104851
- https://github.com/fsspec/filesystem_spec/pull/2029
- https://github.com/fsspec/filesystem_spec/pull/2039
- https://github.com/fsspec/filesystem_spec/commit/86438783f93b1398ef245b92f0e6063b445b611c
- https://github.com/fsspec/filesystem_spec/commit/a1c16ab3f07f354aa371c38f7b1b07ea7fd4c5c8
- https://github.com/fsspec/filesystem_spec
- https://github.com/fsspec/filesystem_spec/releases/tag/2026.6.0
- https://pypi.org/project/fsspec
- https://github.com/advisories/GHSA-27vj-qcqg-25rc
CVE-2026-104851 · published · modified · JSON