PT-2026-25586 · Memray · Memray

0Xmrma · Published 2026-03-15 · Updated 2026-03-19 · CVE-2026-32722

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Memray versions prior to 1.19.2

Description Memray, a memory profiler for Python, did not properly escape command line arguments when rendering them into generated HTML reports. This allowed attacker-controlled command line arguments to be inserted as raw HTML into the report. When a victim opens the generated report in a browser, this can lead to JavaScript execution. The issue affects reports generated by both memray flamegraph and memray table commands, with or without the --no-web option. An attacker who can influence the script name or command-line arguments of a profiled program can inject HTML/JavaScript into Memray-generated HTML reports. The root cause is the lack of HTML escaping when embedding process command line arguments into the generated flame graph or table report using Jinja.

Recommendations Upgrade to Memray version 1.19.2. Avoid attaching Memray to untrusted processes until you have upgraded.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-32722

GHSA-R5PR-887V-M2W9

Affected Products

Memray

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32722.json · Exploit
• https://github.com/bloomberg/memray/security/advisories/GHSA-r5pr-887v-m2w9 · Vendor Advisory
• https://github.com/bloomberg/memray/commit/ba6e4e2e9930f9641bed7adfdf43c8e2545ce249 · Patch
• https://ubuntu.com/security/CVE-2026-32722 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-32722 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32722 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-32722 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-32722 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-32722 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-32722 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r5pr-887v-m2w9 · Vendor Advisory
• https://github.com/bloomberg/memray/releases/tag/v1.19.2 · Note
• https://github.com/bloomberg/memray · Note
• https://twitter.com/CVEnew/status/2034520421798674842 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2033318220908691490 · Twitter Post