CVE-2026-104851: fsspec Remote Code Execution via Server-Side Template Injection
Summary
CVE-2026-104851: fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution. Affects fsspec versions >= 0.9.0, < 2026.6.0. Fixed in 2026.6.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
fsspec is a Python package that provides a unified interface for various file systems, allowing users to interact with local and remote file systems seamlessly. It is widely used in data science and cloud computing environments, particularly for handling large datasets. The package's functionality includes reading and writing files across different storage backends, such as local file systems, cloud storage, and distributed file systems. However, a critical vulnerability has been identified in the ReferenceFileSystem implementation, which can lead to remote code execution due to improper handling of user-supplied JSON documents.
Vulnerability Detail
The vulnerability arises from the way fsspec's ReferenceFileSystem processes JSON documents that contain Jinja2 template strings. Specifically, the package uses un-sandboxed Jinja2 template rendering, allowing an attacker to inject arbitrary Python code through specially crafted JSON. This can occur when a user opens a reference file system pointing to a malicious URL or JSON document. The affected code paths are located in the reference.py file, where the templates are rendered without any security restrictions. The potential ramifications include unauthorized access to the victim's machine, data manipulation, or other malicious activities.
How To Fix
Latest published version: 2026.9.0 as of 22 Oct 2026
pip install --upgrade "fsspec==2026.9.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2026.6.0
This is the first release that contains the fix.
pip install --upgrade "fsspec==2026.6.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the ReferenceFileSystem with untrusted JSON documents or URLs. Ensure that any JSON references are sourced from trusted locations only. Additionally, you can implement a custom template rendering function that uses a sandboxed environment to mitigate the risk of code execution.
Conclusion
The vulnerability CVE-2026-104851 in the fsspec package poses a significant risk due to its potential for remote code execution via server-side template injection. Users are strongly advised to update to the patched version and exercise caution when handling JSON documents from untrusted sources.
See every vulnerability recorded for fsspec →
FAQ
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
All versions of fsspec from 0.9.0 onward are affected by this vulnerability.
You can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring access to the code.
If you cannot update fsspec immediately, avoid using the ReferenceFileSystem with untrusted JSON documents or URLs as a temporary measure.
The impact of this vulnerability includes the potential for remote code execution on the victim's machine, leading to unauthorized access and manipulation of data.
References
Related vulnerabilities
Recent vulnerabilities recorded for fsspec.
