fsspec ReferenceFileSystem: Server-side template injection leads to code execution
Summary
fsspec's ReferenceFileSystem renders template expressions in Kerchunk reference JSON documents with an unrestricted Jinja2 engine. A crafted reference document, supplied inline or fetched from an attacker-controlled URL, can run arbitrary Python code when the reference filesystem is opened, including via consumers such as xarray and before any referenced data is read. The gen array path is always affected, while other paths depend on template-related options and values. User interaction is required, as a victim must open the attacker's reference document.
Affected
- fsspec (Python package) from 0.9.0 up to, but not including, 2026.6.0
- Component: fsspec.implementations.reference.ReferenceFileSystem
Fixed in
- Fixed in fsspec 2026.6.0
- Pin fsspec>=2026.6.0 (2026.9.0 is also available)
- Linux distribution packages: Unknown; check the distribution trackers
Workaround
- No vendor-documented configuration workaround is known.
- Until patched, do not open Kerchunk/reference documents or reference:// URLs from untrusted sources.
Exploitation
- CISA SSVC: exploitation status 'poc', automatable 'no', technical impact 'total'.
- Public proof of concept is likely; the advisory describes how to reproduce the issue.
- Exploitation in the wild: Unknown.
Our recommendation
- Inventory Python environments for fsspec (pip show fsspec or pip-audit), including transitive dependencies of torch, huggingface-hub and similar packages.
- Upgrade to fsspec 2026.6.0 or later and rebuild containers, virtual environments and lockfiles.
- Until patched, do not open reference documents from untrusted sources; prioritise systems that process external data.
- Monitor for vendor and distribution updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-27vj-qcqg-25rc github.com
- fsspec release 2026.6.0 github.com
- Fix commit 86438783 github.com
- Fix commit a1c16ab3 github.com
- Pull request 2029: Honour simple_templates github.com
- Pull request 2039: Small safety improvements github.com
- GitLab advisory for fsspec CVE-2026-104851 advisories.gitlab.com
- OSV GHSA-27vj-qcqg-25rc osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 22:44.
Original description (NVD)
fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0, fsspec.implementations.reference.ReferenceFileSystem evaluates fields from Kerchunk reference JSON documents through unrestricted jinja2.Template(...).render(...) calls in _process_references1._render_jinja, _process_templates, and _process_gen in fsspec/implementations/reference.py. A document supplied inline or fetched from an attacker-controlled URL can provide template expressions that execute Python code when the reference filesystem is opened, including through consumers such as xarray, before referenced data is read. The _process_gen path is reached whenever a document includes a gen array, while the other paths depend on template-related options and values. This issue is fixed in version 2026.6.0.
NVD references (7)
- https://github.com/fsspec/filesystem_spec/commit/86438783f93b1398ef245b92f0e6063b445b611c
- https://github.com/fsspec/filesystem_spec/commit/a1c16ab3f07f354aa371c38f7b1b07ea7fd4c5c8
- https://github.com/fsspec/filesystem_spec/pull/2029
- https://github.com/fsspec/filesystem_spec/pull/2039
- https://github.com/fsspec/filesystem_spec/releases/tag/2026.6.0
- https://github.com/fsspec/filesystem_spec/security/advisories/GHSA-27vj-qcqg-25rc
- https://github.com/fsspec/filesystem_spec/security/advisories/GHSA-27vj-qcqg-25rc
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.