A template injection flaw exists in the fsspec ReferenceFileSystem implementation. The library blindly evaluates Jinja2 template expressions found in Kerchunk reference JSON files, allowing an attacker to embed arbitrary Python code that is executed when the filesystem is accessed. The flaw can compromise confidentiality, integrity, and availability by running attacker‐trusted commands, reading or modifying local data, or establishing persistence. The weakness is based on unrestricted template evaluation (CWE‑1336) and the injection of code via template rendering (CWE‑94).

The vulnerability affects all releases of fsspec from version 0.9.0 up to and including 2026.6.0. Any deployment using the ReferenceFileSystem component of the fsspec:filesystem_spec library and loading reference JSON documents—either inline or from a remote URL—without proper filtering may be impacted.

The CVSS score of 8.8 classifies the issue as high severity. Exploitation requires the ability to supply a crafted reference JSON file that contains Jinja2 expressions; the code is executed automatically when the filesystem is opened, which can happen through direct use or through third‑party consumers such as xarray. No EPSS data is available, but the lack of a KEV listing does not reduce the risk—mission‑critical code execution remains possible, especially in environments that treat reference files as untrusted inputs.