GHSA-m88m-crr9-jvqq

OpenRefine vulnerable to zip slip in project import

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-37476

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.openrefine:main	< 3.7.4	3.7.4

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution if a user can be convinced to import it. ### Patches The vulnerability exists in all versions of OpenRefine up to and including 3.7.3. Users should update to OpenRefine 3.7.4 as soon as possible. ### Workarounds Only import OpenRefine projects from trusted sources. ### References A similar [issue](https://github.com/OpenRefine/OpenRefine/issues/1840) existed in the Create Project feature ([CVE-2018-19859](https://nvd.nist.gov/vuln/detail/CVE-2018-19859)), which was fixed by PR [#1901](https://github.com/OpenRefine/OpenRefine/pull/1901).

References

External links from the advisory. They lead to third-party sites.