{"id":"CVE-2026-93349","title":"Frictionless through 5.20.0rc1 contains an OS command injection vulnerability in the explore console command that allows an attacker who supplies a crafted Data Package descriptor to execute arbitrary operating system commands as the use…","summary":"Frictionless through 5.20.0rc1 contains an OS command injection vulnerability in the explore console command that allows an attacker who supplies a crafted Data Package descriptor to execute arbitrary operating system commands as the use…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":["CWE-78"],"vendor":"frictionlessdata","product":"frictionless-py","affected":["frictionless-py <= 5.20.0rc1"],"published":"2026-09-23","updated":"2026-09-23","sourceUpdated":"2026-09-23T19:19:44.883","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-93349","references":[{"url":"https://github.com/SaiTeja-Erukude/CVE-2026-93349-frictionless-command-injection","label":"disclosure@vulncheck.com"},{"url":"https://github.com/frictionlessdata/frictionless-py/pull/1820","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/frictionless-os-command-injection-via-explore-console-command","label":"disclosure@vulncheck.com"}],"tags":["nvd","cve.org","exploit-available"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-09-23T18:40:06.650125Z"},"ingestedAt":"2026-09-23T17:28:14.849Z","slug":"CVE-2026-93349","body":"## Overview\n\nFrictionless through 5.20.0rc1 contains an OS command injection vulnerability in the explore console command that allows an attacker who supplies a crafted Data Package descriptor to execute arbitrary operating system commands as the user who explores it. Attackers can place shell metacharacters in resource path values within a datapackage.json descriptor, which are passed unsanitized to os.system through a shell, causing arbitrary command execution in the victim's security context when they run the explore command against the untrusted package.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":60,"depthScoreParts":{"impact":48.4,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":209843,"id":"CVE-2026-93349","ts":1790191908090,"field":"exploit_available","old":"false","new":"true"}]}