CVE-2026-93349: OS command injection vulnerability in Frictionless

Frictionless through version 5.20.0rc1 contains an OS command injection vulnerability in the explore console command. An attacker can use a crafted Data Package descriptor to execute arbitrary operating system commands in the victim’s security context.