PT-2026-34599 · Pyspector · Pyspector

Fg0X0 · Published 2026-04-16 · Updated 2026-04-23 · CVE-2026-41206

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PySpector versions prior to 0.1.8

Description The plugin security validator uses AST-based static analysis to prevent dangerous code from being loaded as plugins. The blocklist implemented in the validate plugin code() function is incomplete and can be bypassed using several Python constructs that are not checked. An attacker who can supply a plugin file can achieve arbitrary code execution within the process when that plugin is installed and executed.

Recommendations Update to version 0.1.8.

Exploit

Fix

Incomplete List of Disallowed Inputs

Weakness Enumeration

CWE-184

Related Identifiers

CVE-2026-41206

GHSA-VP22-38M5-R39R

Affected Products

Pyspector

References · 7

• 🔥 https://github.com/ParzivalHack/PySpector/security/advisories/GHSA-vp22-38m5-r39r · Exploit
• https://github.com/ParzivalHack/PySpector/commit/4e279e078c53d760fd321ff9b698d683c65ccb8e · Patch
• https://github.com/ParzivalHack/PySpector/commit/3c9547157fc07396f22b26b3484a9a91eba98555 · Patch
• https://osv.dev/vulnerability/GHSA-vp22-38m5-r39r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41206 · Security Note
• https://github.com/ParzivalHack/PySpector · Note
• https://twitter.com/CVEnew/status/2047359899672195145 · Twitter Post