{
  "cveId": "CVE-2024-49760",
  "url": "https://patchblox.com/security/cve/CVE-2024-49760",
  "summary": "CVE-2024-49760 is fixed in openrefine on 1 platform, first by openrefine 3.5.2-1ubuntu0.1~esm1, released October 24, 2024. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "openrefine: OpenRefine is a free, open source tool for working with messy data",
  "description": "OpenRefine is a free, open source tool for working with messy data. Theload-language command expects a \u0060lang\u0060 parameter from which it constructsthe path of the localization file to load, of the form\u0060translations-$LANG.json\u0060. But when doing so in versions prior to 3.8.3, itdoes not check that the resulting path is in the expected directory, whichmeans that this command could be exploited to read other JSON files on thefile system. Version 3.8.3 addresses this issue.",
  "published": "2024-10-24T15:15:00Z",
  "severity": "Medium",
  "cvss": 5.3,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "epss": 0.0059,
  "epssPercentile": 0.48447,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "openrefine",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "3.6.2-2\u002Bdeb12u3",
      "fix": "DEBIAN-CVE-2024-49760",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-49760",
      "released": "2024-10-24T22:15:04Z"
    },
    {
      "platform": "linux",
      "product": "openrefine",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "3.8.7-1",
      "fix": "DEBIAN-CVE-2024-49760",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-49760",
      "released": "2024-10-24T22:15:04Z"
    },
    {
      "platform": "linux",
      "product": "openrefine",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "3.5.2-1ubuntu0.1~esm1",
      "fix": "openrefine 3.5.2-1ubuntu0.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-openrefine-3.5.2-1ubuntu0.1-esm1",
      "released": "2024-10-24T15:15:00Z"
    },
    {
      "platform": "linux",
      "product": "openrefine",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "3.7.7-1ubuntu0.1~esm1",
      "fix": "openrefine 3.7.7-1ubuntu0.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-openrefine-3.7.7-1ubuntu0.1-esm1",
      "released": "2024-10-24T15:15:00Z"
    },
    {
      "platform": "linux",
      "product": "openrefine",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "3.7.8-1ubuntu0.1",
      "fix": "openrefine 3.7.8-1ubuntu0.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-openrefine-3.7.8-1ubuntu0.1",
      "released": "2026-01-16T01:42:23Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}