CVE-2026-104851: fsspec Remote Code Execution via Server-Side Template Injection
Summary
CVE-2026-104851: fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution. Affects fsspec versions >= 0.9.0, < 2026.6.0. Fixed in 2026.6.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
fsspec is a Python package that provides a unified interface for file system operations across various storage backends. It is widely used in data science applications, particularly for handling cloud-optimized views of data formats like HDF5 and NetCDF. The package allows users to interact with remote file systems seamlessly, making it a valuable tool in the Pangeo and Earth-observation ecosystems. However, a critical vulnerability has been identified that allows for remote code execution due to improper handling of template rendering.
Vulnerability Detail
The vulnerability arises from the ReferenceFileSystem implementation in fsspec, which processes a JSON document containing references. The parser uses un-sandboxed Jinja2 template rendering, allowing an attacker to inject arbitrary Python code through crafted JSON. This can lead to remote code execution on the victim's machine when they access the malicious JSON document. The vulnerability affects all versions of fsspec from 0.9.0 onward, with the most severe impact occurring when the JSON contains a 'gen' field, which is always processed.
How To Fix
Latest published version: 2026.9.0 as of 22 Oct 2026
pip install --upgrade "fsspec==2026.9.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2026.6.0
This is the first release that contains the fix.
pip install --upgrade "fsspec==2026.6.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the ReferenceFileSystem with untrusted JSON documents until you can update to the patched version. Additionally, you can implement your own validation of the JSON input to prevent the execution of potentially harmful templates.
Conclusion
The vulnerability identified as CVE-2026-104851 in the fsspec package poses a significant risk due to its potential for remote code execution via server-side template injection. Users are strongly advised to update to the latest patched version to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for fsspec →
FAQ
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring signup.
If exploited, this vulnerability can lead to arbitrary code execution on the victim's machine, potentially allowing attackers to compromise the system.
Yes, a proof of concept has been provided that demonstrates how an attacker can exploit this vulnerability to execute arbitrary commands on the victim's machine.
If you cannot update the package right away, ensure that you do not use the vulnerable features with untrusted input, and consider implementing additional input validation.
References
Related vulnerabilities
Recent vulnerabilities recorded for fsspec.
