PT-2026-26197 · Pyspector · Pyspector

Satoridev01 · Publicado 2026-03-18 · Atualizado 2026-03-21 · CVE-2026-33140

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PySpector versions prior to 0.1.7

Description PySpector, a static analysis security testing (SAST) Framework, is affected by a stored Cross-Site Scripting (XSS) issue in its HTML report generator. When scanning a Python file containing JavaScript payloads (for example, within a string passed to eval()), the flagged code snippet is included in the HTML report without proper sanitization. Opening the generated report in a browser causes the embedded JavaScript to execute within the browser’s local file context. An attacker can craft a malicious Python file and, when scanned by PySpector and opened by a victim, can achieve arbitrary DOM manipulation, redirects to attacker-controlled pages, and potential theft of locally accessible data. The eval() function is used to execute the JavaScript payload.

Recommendations Versions prior to 0.1.7 should be updated to version 0.1.7 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-33140

GHSA-2GMV-2R3V-JXJ2

Produtos afetados

Pyspector

Referências · 5

• https://github.com/ParzivalHack/PySpector · Nota
• https://github.com/ParzivalHack/PySpector/security/advisories/GHSA-2gmv-2r3v-jxj2 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-33140 · Nota de Segurança
• https://twitter.com/CVEnew/status/2035262164286500937 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-2gmv-2r3v-jxj2 · Aviso do Fabricante