{"affected":[{"defaultStatus":"unaffected","ecosystem":"github","packageName":"frictionlessdata/frictionless-py","product":"frictionless-py","source":"CNA: VulnCheck","vendor":"frictionlessdata","versions":[{"lessThan":"5.19.1","status":"affected","version":"0","versionType":"semver"},{"lessThan":"5.20.0rc2","status":"affected","version":"5.20.0rc1","versionType":"custom"}]}],"cveId":"CVE-2026-93349","cwes":["CWE-78"],"description":"Frictionless before 5.19.1 contains an OS command injection vulnerability in the explore console command that allows an attacker who supplies a crafted Data Package descriptor to execute arbitrary operating system commands as the user who explores it. Attackers can place shell metacharacters in resource path values within a datapackage.json descriptor, which are passed unsanitized to os.system through a shell, causing arbitrary command execution in the victim's security context when they run the explore command against the untrusted package. This vulnerability was also addressed in version 5.20.0rc2 of the pre-release branch.","epss":{"date":"2026-11-08","percentile":0.81958,"score":0.02116},"exploits":[{"kind":"exploit","source":"CNA: VulnCheck","url":"https://github.com/SaiTeja-Erukude/CVE-2026-93349-frictionless-command-injection"}],"kev":null,"metrics":[{"score":8.6,"severity":"high","source":"CNA: VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0"},{"score":8.8,"severity":"high","source":"CNA: VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1794146961788,"publishedAt":1790181297201,"references":[{"source":"CNA: VulnCheck","tags":["technical-description","exploit"],"url":"https://github.com/SaiTeja-Erukude/CVE-2026-93349-frictionless-command-injection"},{"source":"CNA: VulnCheck","tags":["issue-tracking","patch"],"url":"https://github.com/frictionlessdata/frictionless-py/pull/1820"},{"source":"CNA: VulnCheck","tags":["release-notes"],"url":"https://github.com/frictionlessdata/frictionless-py/releases/tag/v5.19.1"},{"source":"CNA: VulnCheck","tags":["release-notes"],"url":"https://github.com/frictionlessdata/frictionless-py/releases/tag/v5.20.0rc2"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/frictionless-os-command-injection-via-explore-console-command"}],"remediation":[{"kind":"fix","source":"CNA: VulnCheck","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/frictionlessdata/frictionless-py/pull/1820"}],"revision":"8d6387f1a36aa3bac129fa1db98481cb83ea0d4979f1772325478e5088d5c984","sources":[{"modifiedAt":1794146961788,"name":"CNA: VulnCheck","retrievedAt":1794151406018,"url":"https://www.cve.org/CVERecord?id=CVE-2026-93349"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794151407700,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-93349"}],"ssvc":{"assessedAt":1790188806650,"automatable":"no","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Frictionless OS Command Injection via explore Console Command","updatedAt":1794151407700}