Description
Frictionless through 5.20.0rc1 contains an OS command injection vulnerability in the explore console command that allows an attacker who supplies a crafted Data Package descriptor to execute arbitrary operating system commands as the user who explores it. Attackers can place shell metacharacters in resource path values within a datapackage.json descriptor, which are passed unsanitized to os.system through a shell, causing arbitrary command execution in the victim's security context when they run the explore command against the untrusted package.
Published: 2026-09-23
Score: 8.6 High
EPSS: n/a
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is an OS command injection in the explore console command of frictionless-py. A malicious user can embed shell metacharacters within resource path values of a datapackage.json descriptor. When the explore command processes that descriptor, the unsanitized values are passed to os.system via a shell, allowing the attacker to run arbitrary operating system commands with the privileges of the user invoking explore.

Affected Systems

The affected product is frictionlessdata’s frictionless-py, specifically version 5.20.0rc1 and earlier. Any installation of this library that processes untrusted datapackage.json files using the explore command is vulnerable to this command injection flaw.

Risk and Exploitability

The CVSS score of 8.6 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, so no publicly documented exploits are known. Exploitation requires the attacker to deliver a crafted datapackage.json to the victim and have the victim run the explore command; therefore the attack vector is local software execution. Prompt patching is recommended to eliminate the risk of arbitrary command execution.

Generated by OpenCVE AI on September 23, 2026 at 17:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade frictionless-py to a version that contains the command‑injection fix, such as 5.20.0rc2 or later.
  • If an upgrade is not possible, refrain from using the explore command with any untrusted datapackage.json files.
  • Deploy the tool in an isolated environment with restricted user permissions, or run it under a dedicated, least‑privileged account.
  • Validate or sanitize resource path fields before they are passed to the explore command to prevent shell metacharacters.

Generated by OpenCVE AI on September 23, 2026 at 17:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 23 Sep 2026 16:45:00 +0000

Type Values Removed Values Added
Description Frictionless through 5.20.0rc1 contains an OS command injection vulnerability in the explore console command that allows an attacker who supplies a crafted Data Package descriptor to execute arbitrary operating system commands as the user who explores it. Attackers can place shell metacharacters in resource path values within a datapackage.json descriptor, which are passed unsanitized to os.system through a shell, causing arbitrary command execution in the victim's security context when they run the explore command against the untrusted package.
Title Frictionless OS Command Injection via explore Console Command
Weaknesses CWE-78
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-23T18:40:13.306Z

Reserved: 2026-09-17T18:41:40.757Z

Link: CVE-2026-93349

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-23T17:17:19.653

Modified: 2026-09-23T19:19:44.883

Link: CVE-2026-93349

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-23T17:30:06Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')