PHP security status for OpenRefine

Support and Helpdesk
1

Hello!

As you are all aware, there are two recently disclosed critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) which can allow for unauthenticated remote code execution. I am using OpenRefine on my system. Please confirm:

  1. Is this version vulnerable to CVE-2026-109618 or CVE-2026-109619?
  2. If yes, what patch or upgrade fixes it, when will it be available, and how do I obtain it?

Thank you!

2

Openrefine doesn’t use PHP and so is not affected by these vulnerabilities as far as I am aware