GHSA-9437-39hj-3c93
Apache Spark History Server allows stored cross-site scripting through unescaped application names
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2026-32773
- Alias
- BIT-spark-2026-32773, PYSEC-2026-3966
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Description
There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged to upgrade to Spark 3.5.8 or later. This CVE is marked as "low" since the path to exploit requires both relatively high permissions (ability to launch a Spark job) and requires tricking a user with higher permissions to log in and visit the Spark history web page. Users are encouraged to upgrade their Spark history servers to Spark 3.5.8 or later.
Paquets affectés
| Paquet | Versions |
|---|---|
| PyPI · pyspark | introduced 3.0.0, fixed 3.5.8 |
| Maven · org.apache.spark:spark-core_2.12 | introduced 3.0.0, fixed 3.5.8 |
| Maven · org.apache.spark:spark-core_2.13 | introduced 3.0.0, fixed 3.5.8 |
Références
- https://nvd.nist.gov/vuln/detail/CVE-2026-32773 ADVISORY
- https://github.com/apache/spark/pull/52851 WEB
- https://github.com/apache/spark/commit/3c83c2c6a22fe384280b99bb753b14800b7e27e1 WEB
- https://github.com/apache/spark/commit/e739b7d349dbd41b78d49bc8086cab63db057e14 WEB
- https://github.com/apache/spark PACKAGE
- https://github.com/pypa/advisory-database/tree/main/vulns/pyspark/PYSEC-2026-3966.yaml WEB
- https://issues.apache.org/jira/browse/SPARK-53747 WEB
- https://lists.apache.org/thread/k36prh3oxl1z6ov7w8rpmfnt07hmzw3v WEB
- http://www.openwall.com/lists/oss-security/2026/09/01/4 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |