CVE-2026-33140mediumCWE-79

CVE-2026-33140: medium-severity vulnerability in ParzivalHack PySpector

PySpector: Stored XSS in PySpector HTML Report Generation leads to Javascript Code Execution

Published · Updated

Follow this CVE+ Monitor PySpector+ Monitor pyspector

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.2%
PySpector is a static analysis security testing (SAST) Framework engineered for modern Python development workflows. PySpector versions 0.1.6 and prior are affected by a stored Cross-Site Scripting (XSS) vulnerability in the HTML report generator. When PySpector scans a Python file containing JavaScript payloads (i.e. inside a string passed to eval() ), the flagged code snippet is interpolated into the HTML report without sanitization. Opening the generated report in a browser causes the embedded JavaScript to execute in the browser's local file context. This issue has been patched in version 0.1.7.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Affected products
ParzivalHack · PySpector
Related CVEs — ParzivalHack PySpector

In the same product, most dangerous first.

CVE-2026-41206MEDIUMPySpector has a Plugin Code Execution Bypass via Incomplete Static Analysis in PluginSecurity.validate_plugin_codeEPSS 0.2%CVE-2026-33139HIGHPySpector: Plugin Sandbox Bypass leads to Arbitrary Code ExecutionEPSS 0.2%