CVE-2023-37476 - CVE House

Back to Database

Status published Medium CVE-2023-37476

Zip slip in OpenRefine

5.5 CVSS

Vulnerability Description

OpenRefine is a free, open source tool for data processing. A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution in the context of the OpenRefine process if a user can be convinced to import it. The vulnerability exists in all versions of OpenRefine up to and including 3.7.3. Users should update to OpenRefine 3.7.4 as soon as possible. Users unable to upgrade should only import OpenRefine projects from trusted sources.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-37476

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from OpenRefine

View All →

OpenRefine has a path traversal in LoadLanguageCommand

Butterfly has path/URL confusion in resource handling leading to multiple weaknesses

OpenRefine's error page lacks escaping, leading to potential Cross-site Scripting on import of malicious project

OpenRefine's SQLite integration allows filesystem access, remote code execution (RCE)

OpenRefine has a reflected cross-site scripting vulnerability from POST request in ExportRowsCommand

Affected Vendor

OpenRefine

View all reports →

Affected Software

OpenRefine

Vulnerable Versions:

< 3.7.4

Timeline

Official Publish: July 17th, 2023

Last Modified: June 10th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1005 Data from Local System

T1552 Unsecured Credentials

Credential Access

T1565.001 Stored Data Manipulation