CVE-2026-93349 in frictionless-py
Summary
by MITRE • 09/23/2026
Frictionless through 5.20.0rc1 contains an OS command injection vulnerability in the explore console command that allows an attacker who supplies a crafted Data Package descriptor to execute arbitrary operating system commands as the user who explores it. Attackers can place shell metacharacters in resource path values within a datapackage.json descriptor, which are passed unsanitized to os.system through a shell, causing arbitrary command execution in the victim's security context when they run the explore command against the untrusted package.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability identified in Frictionless versions prior to 5.20.0rc1 represents a critical OS Command Injection flaw located within the explore console command functionality. This issue stems from improper neutralization of special elements used in an operating system shell, specifically categorized under CWE-78: Improper Neutralization of Special Elements used in an OS Command. The root cause lies in how the application processes resource path values contained within a Data Package descriptor file, typically named datapackage.json. When a user initiates the explore command against such a package, the software constructs system-level commands to handle or display data from these resources. However, the implementation fails to adequately sanitize input fields before passing them to underlying operating system interfaces.
The technical mechanism of exploitation involves an attacker crafting a malicious Data Package descriptor where specific resource path values contain shell metacharacters. These characters are not filtered or escaped by the application logic. Instead, they are passed unsanitized directly into calls involving os.system through a shell interpreter. Because the shell interprets these special characters as commands rather than literal data strings, an attacker can inject arbitrary operating system commands that execute with the privileges of the user running the explore command. This lack of input validation allows for complete bypass of intended application controls, turning a standard data exploration feature into a vector for remote code execution if untrusted packages are processed in privileged environments or by users with significant access rights.
The operational impact of this vulnerability is severe, as it grants an attacker the ability to execute arbitrary commands on the host system within the security context of the victim user. Depending on the permissions assigned to that user, this could lead to full compromise of the underlying operating system, unauthorized data exfiltration, or lateral movement across a network if the compromised machine serves as a pivot point. The risk is particularly acute in scenarios where users are expected to import and explore datasets from external sources without rigorous pre-validation, such as in collaborative analytics platforms or public-facing data portals. An attacker does not need direct access to the server; they only need to trick a privileged user into exploring a maliciously crafted package hosted on an accessible location.
From a threat intelligence perspective, this vulnerability aligns with ATT&CK technique T1059: Command and Scripting Interpreter, specifically sub-techniques involving shell commands like sh or cmd.exe depending on the operating system. It also reflects common patterns found in CWE-20: Improper Input Validation where external data is used to construct dynamic queries or commands without sufficient verification of its integrity or safety. The failure to implement a whitelist approach for allowed characters or paths, combined with the use of shell execution functions that inherently interpret special syntax, creates a predictable and exploitable weakness.
Mitigation strategies must focus on immediate patching and architectural changes to prevent similar occurrences in future development cycles. Organizations should upgrade Frictionless to version 5.20.0rc1 or later as soon as possible, as this release addresses the sanitization issues within the explore console command. For environments where upgrading is not immediately feasible, strict input validation must be implemented at the application layer before any data package descriptors are processed. This includes rejecting resource path values that contain shell metacharacters such as semicolons, pipes, ampersands, or backticks. Additionally, developers should avoid using os.system for executing commands derived from user-supplied inputs and instead utilize safer alternatives like subprocess.run with a list of arguments, which bypasses the shell entirely and treats each argument as a distinct token rather than parsing it through a command interpreter.