{
  "cveId": "CVE-2023-37476",
  "url": "https://patchblox.com/security/cve/CVE-2023-37476",
  "summary": "CVE-2023-37476 is fixed in openrefine on 1 platform, first by DEBIAN-CVE-2023-37476, released July 17, 2023. It is not reported as exploited. Patch Radar priority: High.",
  "title": "openrefine: OpenRefine is a free, open source tool for data processing",
  "description": "OpenRefine is a free, open source tool for data processing. A carefullycrafted malicious OpenRefine project tar file can be used to triggerarbitrary code execution in the context of the OpenRefine process if a usercan be convinced to import it. The vulnerability exists in all versions ofOpenRefine up to and including 3.7.3. Users should update to OpenRefine3.7.4 as soon as possible. Users unable to upgrade should only importOpenRefine projects from trusted sources.",
  "published": "2023-07-17T15:15:00Z",
  "severity": "Medium",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
  "epss": 0.00625,
  "epssPercentile": 0.50243,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "openrefine",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "3.6.2-2\u002Bdeb12u1",
      "fix": "DEBIAN-CVE-2023-37476",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-37476",
      "released": "2023-07-17T22:15:09Z"
    },
    {
      "platform": "linux",
      "product": "openrefine",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "3.6.2-3",
      "fix": "DEBIAN-CVE-2023-37476",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-37476",
      "released": "2023-07-17T22:15:09Z"
    },
    {
      "platform": "linux",
      "product": "openrefine",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "3.5.2-1ubuntu0.1~esm1",
      "fix": "openrefine 3.5.2-1ubuntu0.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-openrefine-3.5.2-1ubuntu0.1-esm1",
      "released": "2024-10-24T15:15:00Z"
    },
    {
      "platform": "linux",
      "product": "openrefine",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "3.7.7-1ubuntu0.1~esm1",
      "fix": "openrefine 3.7.7-1ubuntu0.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-openrefine-3.7.7-1ubuntu0.1-esm1",
      "released": "2024-10-24T15:15:00Z"
    },
    {
      "platform": "linux",
      "product": "openrefine",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "3.7.8-1ubuntu0.1",
      "fix": "openrefine 3.7.8-1ubuntu0.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-openrefine-3.7.8-1ubuntu0.1",
      "released": "2026-01-16T01:42:23Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}