Read the docs
TI-2026-25570 Aliases CVE-2026-33140GHSA-2gmv-2r3v-jxj2

PySpector: Stored XSS in PySpector HTML Report Generation leads to Javascript Code Execution

Priority MEDIUM 63CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

PySpector is a static analysis security testing (SAST) Framework engineered for modern Python development workflows. PySpector versions 0.1.6 and prior are affected by a stored Cross-Site Scripting (XSS) vulnerability in the HTML report generator. When PySpector scans a Python file containing JavaScript payloads (i.e. inside a string passed to eval() ), the flagged code snippet is interpolated into the HTML report without sanitization. Opening the generated report in a browser causes the embedded JavaScript to execute in the browser's local file context. This issue has been patched in version 0.1.7.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00231 13th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed PySpector (ParzivalHack): 0.1.7pyspector (PyPI): 0.1.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ParzivalHackPySpectorbefore 0.1.70.1.7Patch availableCNA
—pyspector (PyPI)before 0.1.70.1.7Patch availableGHSA-2gmv-2r3v-jxj2
  • PySpector VendorParzivalHack Affected before 0.1.7 Fixed in 0.1.7 Patch available CNA
  • pyspector (PyPI) Vendor— Affected before 0.1.7 Fixed in 0.1.7 Patch available GHSA-2gmv-2r3v-jxj2

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:parzivalhack:pyspector:*:*:*:*:*:python:*:*before 0.1.7VulnerableParzivalHack
  • cpe:2.3:a:parzivalhack:pyspector:*:*:*:*:*:python:*:* Versions before 0.1.7 Vulnerable ·ParzivalHack

Remediation

  • Fix · CNA PySpector (ParzivalHack) Fixed in 0.1.7
  • Fix · GHSA-2gmv-2r3v-jxj2 pyspector (PyPI) Fixed in 0.1.7 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33140
  2. 2026-10-03 Alias added: GHSA-2gmv-2r3v-jxj2

References

Exploit 1

Advisory 1

Other 1

  • TI-2026-25569 PySpector: Plugin Sandbox Bypass leads to Arbitrary Code Execution CVSS 4.0HIGH 8.3
  • TI-2026-29825 PySpector has a Plugin Code Execution Bypass via Incomplete Static Analysis in PluginSecurity.validate_plugin_code CVSS 4.0MEDIUM 6.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences