Get real-time updates on Telegram

fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution

CVE-2026-104851 affects fsspec. CVSS base score 8.8 (HIGH, Vendor/CNA). EPSS 0.00317 (percentile 0.22436), scored 2026-10-04. Affected range: >= 0.9.0, < 2026.6.0. Fixed version: 2026.6.0.

Published 2026-10-05 23:10:23.721701+00:00

CVE

CVE-2026-104851

CWE

CWE-94, CWE-1336

Product

fsspec

CCR priority

35.3 /100 (P4)

CVSS

8.8 /10 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · Vendor/CNA

EPSS

0.00317 · percentile 0.22436 · 2026-10-04

KEV

no

Affected products

• fsspec · >= 0.9.0, < 2026.6.0 · Fixed version: 2026.6.0

Provenance

• NVD CVE API 2.0 · Source record · observed 2026-10-05 23:09:08.830529+00:00 UTC
• GitHub Advisory Database · Source record · observed 2026-10-05 23:10:51.172112+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-104851.html