{
  "cveId": "CVE-2024-47881",
  "url": "https://patchblox.com/security/cve/CVE-2024-47881",
  "summary": "CVE-2024-47881 is fixed in openrefine on 1 platform, first by openrefine 3.5.2-1ubuntu0.1~esm1, released October 24, 2024. It is not reported as exploited. Patch Radar priority: High.",
  "title": "openrefine: OpenRefine is a free, open source tool for working with messy data.Starting in version 3.4-beta and prior to version...",
  "description": "OpenRefine is a free, open source tool for working with messy data.Starting in version 3.4-beta and prior to version 3.8.3, in the \u0060database\u0060extension, the \u0022enable_load_extension\u0022 property can be set for the SQLiteintegration, enabling an attacker to load (local or remote) extension DLLsand so run arbitrary code on the server. The attacker needs to have networkaccess to the OpenRefine instance. Version 3.8.3 fixes this issue.",
  "published": "2024-10-24T14:15:00Z",
  "severity": "Medium",
  "cvss": 8.8,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
  "epss": 0.00689,
  "epssPercentile": 0.53036,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "openrefine",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "3.6.2-2\u002Bdeb12u3",
      "fix": "DEBIAN-CVE-2024-47881",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-47881",
      "released": "2024-10-24T21:15:12Z"
    },
    {
      "platform": "linux",
      "product": "openrefine",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "3.8.7-1",
      "fix": "DEBIAN-CVE-2024-47881",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-47881",
      "released": "2024-10-24T21:15:12Z"
    },
    {
      "platform": "linux",
      "product": "openrefine",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "3.5.2-1ubuntu0.1~esm1",
      "fix": "openrefine 3.5.2-1ubuntu0.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-openrefine-3.5.2-1ubuntu0.1-esm1",
      "released": "2024-10-24T15:15:00Z"
    },
    {
      "platform": "linux",
      "product": "openrefine",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "3.7.7-1ubuntu0.1~esm1",
      "fix": "openrefine 3.7.7-1ubuntu0.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-openrefine-3.7.7-1ubuntu0.1-esm1",
      "released": "2024-10-24T15:15:00Z"
    },
    {
      "platform": "linux",
      "product": "openrefine",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "3.7.8-1ubuntu0.1",
      "fix": "openrefine 3.7.8-1ubuntu0.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-openrefine-3.7.8-1ubuntu0.1",
      "released": "2026-01-16T01:42:23Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-10T07:50:38Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}