GHSA-2gmv-2r3v-jxj2

Source

https://github.com/advisories/GHSA-2gmv-2r3v-jxj2

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-2gmv-2r3v-jxj2/GHSA-2gmv-2r3v-jxj2.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-2gmv-2r3v-jxj2

Aliases

CVE-2026-33140
PYSEC-2026-3029

Published

2026-03-18T16:33:46Z

Modified

2026-07-13T16:43:19Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator

Summary

Stored XSS in PySpector HTML Report Generation leads to Javascript Code Execution

Details

Summary

PySpector versions <= 0.1.6 are affected by a stored Cross-Site Scripting (XSS) vulnerability in the HTML report generator. When PySpector scans a Python file containing JavaScript payloads (i.e. inside a string passed to eval() ), the flagged code snippet is interpolated into the HTML report without sanitization. Opening the generated report in a browser causes the embedded JavaScript to execute in the browser's local file context.

Impact

An attacker can craft a malicious Python file (for example, hosted in a public repository), designed to be scanned by PySpector. When a victim scans this file and opens the resulting HTML report, arbitrary JavaScript executes in their browser. While the file:// context limits the attacker's ability to exfiltrate cookies or make credentialed requests, the following is still achievable:

Arbitrary DOM manipulation
Redirects to attacker-controlled pages
Theft of locally accessible data via fetch() or XMLHttpRequest to file:// paths (browser-dependent)

Any user of PySpector who scans untrusted code and generates HTML reports, is potentially affected.

PoC

The following steps reproduce the vulnerability on PySpector <= 0.1.6:

Create a malicious Python file containing a JavaScript payload embedded in a string argument to eval(), and run PySpector against the file, generating an HTML report:
Open the generated HTML report in any browser:

Database specific

{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-03-18T16:33:46Z",
    "nvd_published_at":  "2026-03-20T20:16:49Z",
    "severity":  "MODERATE"
}

References

Affected packages

PyPI / pyspector

Package

Name: pyspector; View open source insights on deps.dev
Purl: pkg:pypi/pyspector

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.1.7

Affected versions

0.*

0.1.1

0.1.2

0.1.3

0.1.4

0.1.4.post1

0.1.5

0.1.6

Database specific

last_known_affected_version_range

"<= 0.1.6"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-2gmv-2r3v-jxj2/GHSA-2gmv-2r3v-jxj2.json"