openrefine: OpenRefine is a free, open source tool for working with messy data

OpenRefine is a free, open source tool for working with messy data. Priorto version 3.8.3, the `export-rows` command can be used in such a way thatit reflects part of the request verbatim, with a Content-Type header alsotaken from the request. An attacker could lead a user to a malicious pagethat submits a form POST that contains embedded JavaScript code. This codewould then be included in the response, along with an attacker-controlled`Content-Type` header, and so potentially executed in the victim's browseras if it was part of OpenRefine. The attacker-provided code can do anythingthe user can do, including deleting projects, retrieving databasepasswords, or executing arbitrary Jython or Closure expressions, if thoseextensions are also present. The attacker must know a valid project ID of aproject that contains at least one row. Version 3.8.3 fixes the issue.

Where it's fixed