CVE-2026-33140

Description

PySpector is a static analysis security testing (SAST) Framework engineered for modern Python development workflows. PySpector versions 0.1.6 and prior are affected by a stored Cross-Site Scripting (XSS) vulnerability in the HTML report generator. When PySpector scans a Python file containing JavaScript payloads (i.e. inside a string passed to eval() ), the flagged code snippet is interpolated into the HTML report without sanitization. Opening the generated report in a browser causes the embedded JavaScript to execute in the browsers local file context. This issue has been patched in version 0.1.7.

Risk Information

Base Score

6.1

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS Score

Exploitation Probability

0.01

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2026-33139,CVE-2026-33140 are fixed in Python-pyspector 0.1.7	Windows
Vulnerabilities CVE-2026-33139,CVE-2026-33140 are fixed in Python-pyspector for linux 0.1.7	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234