{"action":"Upgrade fsspec to 2026.6.0 or later.","affected":[{"fixed":"2026.6.0","introduced":"0.9.0"}],"component":"fsspec","cve_ids":["CVE-2026-104851"],"ecosystem":"PyPI","epss":0.00475,"exploited":false,"fixed_versions":["2026.6.0"],"ghsa_id":"GHSA-27vj-qcqg-25rc","id":"tcs_01M5KES5R4BVNJESGGTD40KRGM","modified_at":"2026-10-15T14:56:18.658408345Z","published_at":"2026-10-05T22:53:22Z","references":["https://osv.dev/vulnerability/GHSA-27vj-qcqg-25rc","https://github.com/fsspec/filesystem_spec/security/advisories/GHSA-27vj-qcqg-25rc","https://nvd.nist.gov/vuln/detail/CVE-2026-104851","https://github.com/fsspec/filesystem_spec/pull/2029","https://github.com/fsspec/filesystem_spec/pull/2039","https://github.com/fsspec/filesystem_spec/commit/86438783f93b1398ef245b92f0e6063b445b611c","https://github.com/fsspec/filesystem_spec/commit/a1c16ab3f07f354aa371c38f7b1b07ea7fd4c5c8","https://github.com/fsspec/filesystem_spec","https://github.com/fsspec/filesystem_spec/releases/tag/2026.6.0"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-27vj-qcqg-25rc","url":"https://osv.dev/vulnerability/GHSA-27vj-qcqg-25rc"}],"summary":"fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution"}