PT-2026-25586 · Memray · Memray

0Xmrma · Publicado 2026-03-15 · Atualizado 2026-03-19 · CVE-2026-32722

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Memray versions prior to 1.19.2

Description Memray, a memory profiler for Python, did not properly escape command line arguments when rendering them into generated HTML reports. This allowed attacker-controlled command line arguments to be inserted as raw HTML into the report. When a victim opens the generated report in a browser, this can lead to JavaScript execution. The issue affects reports generated by both memray flamegraph and memray table commands, with or without the --no-web option. An attacker who can influence the script name or command-line arguments of a profiled program can inject HTML/JavaScript into Memray-generated HTML reports. The root cause is the lack of HTML escaping when embedding process command line arguments into the generated flame graph or table report using Jinja.

Recommendations Upgrade to Memray version 1.19.2. Avoid attaching Memray to untrusted processes until you have upgraded.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-32722

GHSA-R5PR-887V-M2W9

Produtos afetados

Memray

Referências · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32722.json · Exploit
• https://github.com/bloomberg/memray/security/advisories/GHSA-r5pr-887v-m2w9 · Aviso do Fabricante
• https://github.com/bloomberg/memray/releases/tag/v1.19.2 · Nota
• https://github.com/bloomberg/memray/commit/ba6e4e2e9930f9641bed7adfdf43c8e2545ce249 · Correção
• https://github.com/bloomberg/memray · Nota
• https://ubuntu.com/security/CVE-2026-32722 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2026-32722 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-32722 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2026-32722 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2026-32722 · Nota de Segurança
• https://twitter.com/CVEnew/status/2034520421798674842 · Publicação no Twitter
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-32722 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-32722 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2033318220908691490 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-r5pr-887v-m2w9 · Aviso do Fabricante