Apache Spark History Server allows stored cross-site scripting through unescaped application names

TRUNG BÌNH 6.1CVE-2026-32773 · BIT-spark-2026-32773 · GHSA-9437-39hj-3c93 · Công bố 02/09/2026 · cập nhật 08/09/2026

Tóm tắt nhanh

CVE-2026-32773 là lỗ hổng mức TRUNG BÌNH (CVSS 6.1) ảnh hưởng org.apache.spark:spark-core_2.12, org.apache.spark:spark-core_2.13, pyspark.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.41%, cao hơn 35.8% các lỗ hổng khác.
Cách xử lý: cập nhật lên 3.5.8 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
org.apache.spark:spark-core_2.12 Maven	`≥ 3.0.0, < 3.5.8`	`3.5.8`
org.apache.spark:spark-core_2.13 Maven	`≥ 3.0.0, < 3.5.8`	`3.5.8`
pyspark PyPI	`≥ 3.0.0, < 3.5.8`	`3.5.8`
spark apache	`≥ 3.0.0, < 3.5.8`	`3.5.8`

Mô tả

This CVE is marked as "low" since the path to exploit requires both relatively high permissions (ability to launch a Spark job) and requires tricking a user with higher permissions to log in and visit the Spark history web page.

Users are encouraged to upgrade their Spark history servers to Spark 3.5.8 or later.

Mô tả của NVD

There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged to upgrade to Spark 3.5.8 or later. This CVE is marked as "low" since the path to exploit requires both relatively high permissions (ability to launch a Spark job) and requires tricking a user with higher permissions to log in and visit the Spark history web page. Users are encouraged to upgrade their Spark history servers to Spark 3.5.8 or later.