CVE-2026-32773

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-32773

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-32773.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-32773

Aliases

Published

2026-09-02T10:51:17Z

Modified

2026-09-10T13:10:56Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Apache Spark: XSS Vulnerability in Spark Web 3.5.4

Details

There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged to upgrade to Spark 3.5.8 or later.

This CVE is marked as "low" since the path to exploit requires both relatively high permissions (ability to launch a Spark job) and requires tricking a user with higher permissions to log in and visit the Spark history web page.

Users are encouraged to upgrade their Spark history servers to Spark 3.5.8 or later.

Database specific

{
    "cna_assigner": "apache",
    "cwe_ids": [
        "CWE-80"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32773.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "3.0.0"
                },
                {
                    "fixed": "3.5.8"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/apache/spark

Affected ranges

Type

GIT

Repo

https://github.com/apache/spark

Events

Introduced

3fdfce3120f307147244e5eaf46d61419a723d50

Fixed

5a48a37b2dbd7b51e3640cd1d947438459556cc6

Database specific

Show details

{
    "cpe": "cpe:2.3:a:apache:spark:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.5.8"
        }
    ],
    "source": "CPE_RANGE"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-32773.json"