Get real-time updates on Telegram

Apache Spark History Server allows stored cross-site scripting through unescaped application names

CVE-2026-32773 affects pyspark. CVSS base score 6.1 (GitHub Advisory Database). EPSS 0.00679 (percentile 0.50656), scored 2026-10-04. Affected range: >= 3.0.0, < 3.5.8. Fixed version: 3.5.8. Affected range: >= 3.0.0, < 3.5.8. Fixed version: 3.5.8. Affected range: >= 3.0.0, < 3.5.8. Fixed version: 3.5.8.

Published 2026-10-05 23:14:26.308668+00:00

CVE

CVE-2026-32773

Product

pyspark

CCR priority

24.6 /100 (P4)

CVSS

6.1 /10 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · GitHub Advisory Database

EPSS

0.00679 · percentile 0.50656 · 2026-10-04

KEV

no

Affected products

• pyspark · >= 3.0.0, < 3.5.8 · Fixed version: 3.5.8
• org.apache.spark:spark-core_2.12 · >= 3.0.0, < 3.5.8 · Fixed version: 3.5.8
• org.apache.spark:spark-core_2.13 · >= 3.0.0, < 3.5.8 · Fixed version: 3.5.8

Provenance

• GitHub Advisory Database · Source record · observed 2026-10-05 23:10:51.172112+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-32773.html