TI-2026-25214 Aliases CVE-2026-32722 GHSA-r5pr-887v-m2w9

Memray-generated HTML reports vulnerable to Stored XSS via unescaped command-line metadata

MEDIUM 60CWE-79Published 2026-03-18 · Updated 2026-03-19

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Memray is a memory profiler for Python. Prior to Memray 1.19.2, Memray rendered the command line of the tracked process directly into generated HTML reports without escaping. Because there was no escaping, attacker-controlled command line arguments were inserted as raw HTML into the generated report. This allowed JavaScript execution when a victim opened the generated report in a browser. Version 1.19.2 fixes the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00321 25th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed memray (bloomberg): 1.19.2memray (PyPI): 1.19.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Bloomberg	memray	before 1.19.2	1.19.2	Patch available	CNA
—	memray (PyPI)	before 1.19.2	1.19.2	Patch available	GHSA-r5pr-887v-m2w9

memray VendorBloomberg Affected before 1.19.2 Fixed in 1.19.2 Patch available CNA
memray (PyPI) Vendor— Affected before 1.19.2 Fixed in 1.19.2 Patch available GHSA-r5pr-887v-m2w9

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:bloomberg:memray::::::python::*	before 1.19.2	Vulnerable	Bloomberg

cpe:2.3:a:bloomberg:memray:*:*:*:*:*:python:*:* Versions before 1.19.2 Vulnerable ·Bloomberg

Remediation

Fix · CNA memray (bloomberg) Fixed in 1.19.2
Fix · GHSA-r5pr-887v-m2w9 memray (PyPI) Fixed in 1.19.2 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2026-32722
2026-10-03 Alias added: GHSA-r5pr-887v-m2w9

References

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences