Frictionless OS Command Injection via explore Console Command
Frictionless before 5.19.1 contains an OS command injection vulnerability in the explore console command that allows an attacker who supplies a crafted Data Package descriptor to execute arbitrary operating system commands as the user who explores it. Attackers can place shell metacharacters in resource path values within a datapackage.json descriptor, which are passed unsanitized to os.system through a shell, causing arbitrary command execution in the victim's security context when they run the explore command against the untrusted package. This vulnerability was also addressed in version 5.20.0rc2 of the pre-release branch.
CVE-2026-93349
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-93349
frictionless-py
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://github.com/frictionlessdata/frictionless-py",
"vendor": "frictionlessdata",
"product": "frictionless-py",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.19.1",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.20.0rc1",
"lessThan": "5.20.0rc2",
"versionType": "custom"
}
],
"packageURL": "pkg:github/frictionlessdata/frictionless-py",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-93349
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #3149 · Revision 1
- Added to Heist Feed
- Publisher date