GHSA-9437-39hj-3c93

Suggest an improvement
Source
https://github.com/advisories/GHSA-9437-39hj-3c93
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-9437-39hj-3c93/GHSA-9437-39hj-3c93.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-9437-39hj-3c93
Aliases
Published
2026-09-02T12:31:29Z
Modified
2026-10-05T23:10:51Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
Apache Spark History Server allows stored cross-site scripting through unescaped application names
Details

There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged to upgrade to Spark 3.5.8 or later.

This CVE is marked as "low" since the path to exploit requires both relatively high permissions (ability to launch a Spark job) and requires tricking a user with higher permissions to log in and visit the Spark history web page.

Users are encouraged to upgrade their Spark history servers to Spark 3.5.8 or later.

Database specific 
{
    "cwe_ids":  [
        "CWE-80"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-10-05T22:53:36Z",
    "nvd_published_at":  "2026-09-02T11:17:20Z",
    "severity":  "MODERATE"
}
References

Affected packages

PyPI / pyspark

Package

Name
pyspark
View open source insights on deps.dev
Purl
pkg:pypi/pyspark

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.0.0
Fixed
3.5.8

Affected versions

3.*
3.0.0
3.0.1
3.0.2
3.0.3
3.1.1
3.1.2
3.1.3
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.4.0
3.4.1
3.4.2
3.4.3
3.4.4
3.5.0
3.5.1
3.5.2
3.5.3
3.5.4
3.5.5
3.5.6
3.5.7

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-9437-39hj-3c93/GHSA-9437-39hj-3c93.json"

Maven / org.apache.spark:spark-core_2.12

Package

Name
org.apache.spark:spark-core_2.12
View open source insights on deps.dev
Purl
pkg:maven/org.apache.spark/spark-core_2.12

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.0.0
Fixed
3.5.8

Affected versions

3.*
3.0.0
3.0.0-preview
3.0.0-preview2
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.4.0
3.4.1
3.4.2
3.4.3
3.4.4
3.5.0
3.5.1
3.5.2
3.5.3
3.5.4
3.5.5
3.5.6
3.5.7

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-9437-39hj-3c93/GHSA-9437-39hj-3c93.json"

Maven / org.apache.spark:spark-core_2.13

Package

Name
org.apache.spark:spark-core_2.13
View open source insights on deps.dev
Purl
pkg:maven/org.apache.spark/spark-core_2.13

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.0.0
Fixed
3.5.8

Affected versions

3.*
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.4.0
3.4.1
3.4.2
3.4.3
3.4.4
3.5.0
3.5.1
3.5.2
3.5.3
3.5.4
3.5.5
3.5.6
3.5.7

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-9437-39hj-3c93/GHSA-9437-39hj-3c93.json"