{"id":"CVE-2026-93349","aliases":[],"cve":{"records":[{"id":"CVE-2026-93349","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-17T18:41:40.757Z","published":"2026-09-23T16:34:57.201Z","modified":"2026-11-08T14:09:21.788Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-11-08T14:09:21.788Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-09-23T18:40:13.306Z"}],"references":[{"url":"https://github.com/SaiTeja-Erukude/CVE-2026-93349-frictionless-command-injection","tags":["technical-description","exploit"],"source":"VulnCheck"},{"url":"https://github.com/frictionlessdata/frictionless-py/pull/1820","tags":["issue-tracking","patch"],"source":"VulnCheck"},{"url":"https://github.com/frictionlessdata/frictionless-py/releases/tag/v5.19.1","tags":["release-notes"],"source":"VulnCheck"},{"url":"https://github.com/frictionlessdata/frictionless-py/releases/tag/v5.20.0rc2","tags":["release-notes"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/frictionless-os-command-injection-via-explore-console-command","tags":["third-party-advisory"],"source":"VulnCheck"}],"weaknesses":[{"id":"CWE-78","description":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","source":"VulnCheck"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-09-23T18:40:06.650125Z","decisions":[{"name":"Exploitation","value":"poc"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"Frictionless OS Command Injection via explore Console Command","titleSource":"VulnCheck","descriptionSource":"VulnCheck","description":"Frictionless before 5.19.1 contains an OS command injection vulnerability in the explore console command that allows an attacker who supplies a crafted Data Package descriptor to execute arbitrary operating system commands as the user who explores it. Attackers can place shell metacharacters in resource path values within a datapackage.json descriptor, which are passed unsanitized to os.system through a shell, causing arbitrary command execution in the victim's security context when they run the explore command against the untrusted package. This vulnerability was also addressed in version 5.20.0rc2 of the pre-release branch.","score":8.8,"severity":"high","published":"2026-09-23T16:34:57.201Z","modified":"2026-11-08T14:09:21.788Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"frictionlessdata","name":"frictionless-py","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"5.19.1","versionType":"semver"},{"version":"5.20.0rc1","status":"affected","lessThan":"5.20.0rc2","versionType":"custom"}],"defaultStatus":"unaffected","packageURL":"pkg:github/frictionlessdata/frictionless-py","cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-93349"}],"remediation":[],"references":["https://github.com/SaiTeja-Erukude/CVE-2026-93349-frictionless-command-injection","https://github.com/frictionlessdata/frictionless-py/pull/1820","https://github.com/frictionlessdata/frictionless-py/releases/tag/v5.19.1","https://github.com/frictionlessdata/frictionless-py/releases/tag/v5.20.0rc2","https://www.vulncheck.com/advisories/frictionless-os-command-injection-via-explore-console-command"],"sources":[{"name":"CVE","id":"CVE-2026-93349","modified":"2026-11-08T14:09:21.788Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-93349"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":8.6},{"source":"VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","score":8.8}],"sourceAffected":[],"observedAt":"2026-11-08T14:32:29.111Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T00:20:33.177Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-08T14:35:34.948Z","attemptedAt":"2026-11-08T14:35:34.948Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-08T14:35:34.956Z","attemptedAt":"2026-11-08T14:35:34.956Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-08T14:35:36.214Z","attemptedAt":"2026-11-08T14:35:36.214Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-08T14:35:34.942Z","attemptedAt":"2026-11-08T14:35:34.942Z"}],"evidence":[{"source":"FIRST EPSS","id":"CVE-2026-93349","url":"https://www.first.org/epss/","probability":0.02116,"percentile":0.81958,"date":"2026-11-08","checkedAt":"2026-11-08T14:35:34.942Z"},{"source":"NVD","id":"CVE-2026-93349","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93349","modified":"2026-09-28T15:17:24.560","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-11-08T14:35:34.948Z"},{"source":"NVD","id":"CVE-2026-93349","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93349","modified":"2026-09-28T15:17:24.560","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","checkedAt":"2026-11-08T14:35:34.948Z"},{"source":"GitHub Advisory Database","id":"GHSA-4jpg-jrw7-h58p","url":"https://github.com/advisories/GHSA-4jpg-jrw7-h58p","modified":"2026-09-28T15:32:32Z","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","checkedAt":"2026-11-08T14:35:34.956Z"},{"source":"ENISA EUVD","id":"EUVD-2026-85420","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-85420","modified":"Sep 28, 2026, 2:48:00 PM","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","checkedAt":"2026-11-08T14:35:36.214Z"}],"aiSummary":{"text":"Frictionless before 5.19.1 has an OS command injection vulnerability in the explore console command, allowing an attacker to execute arbitrary OS commands as the user who explores a crafted Data Package descriptor. The attacker must supply a crafted descriptor with shell metacharacters in resource path values. This affects versions before 5.19.1 and 5.20.0rc2.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-08T14:36:07.130Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-93349"}]}}