PT-2026-26197 · Pyspector · Pyspector

Satoridev01 · Published 2026-03-18 · Updated 2026-03-21 · CVE-2026-33140

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PySpector versions prior to 0.1.7

Description PySpector, a static analysis security testing (SAST) Framework, is affected by a stored Cross-Site Scripting (XSS) issue in its HTML report generator. When scanning a Python file containing JavaScript payloads (for example, within a string passed to eval()), the flagged code snippet is included in the HTML report without proper sanitization. Opening the generated report in a browser causes the embedded JavaScript to execute within the browser’s local file context. An attacker can craft a malicious Python file and, when scanned by PySpector and opened by a victim, can achieve arbitrary DOM manipulation, redirects to attacker-controlled pages, and potential theft of locally accessible data. The eval() function is used to execute the JavaScript payload.

Recommendations Versions prior to 0.1.7 should be updated to version 0.1.7 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-33140

GHSA-2GMV-2R3V-JXJ2

Affected Products

Pyspector

References · 5

• https://github.com/ParzivalHack/PySpector/security/advisories/GHSA-2gmv-2r3v-jxj2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33140 · Security Note
• https://osv.dev/vulnerability/GHSA-2gmv-2r3v-jxj2 · Vendor Advisory
• https://github.com/ParzivalHack/PySpector · Note
• https://twitter.com/CVEnew/status/2035262164286500937 · Twitter Post