CVE-2026-32722: Memray Stored XSS via Unescaped Command-Line Metadata
Summary
CVE-2026-32722: Stored XSS in Memray-generated HTML reports via unescaped command-line metadata. Affects memray versions < 1.19.2. Fixed in 1.19.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Memray is a powerful memory profiler for Python applications, designed to help developers analyze memory usage and identify memory leaks. It generates detailed reports, including flame graphs and tables, to visualize memory allocation. However, prior to version 1.19.2, Memray had a critical vulnerability that allowed for stored cross-site scripting (XSS) attacks through unescaped command-line metadata in its generated HTML reports.
Vulnerability Detail
The vulnerability arises from Memray's use of Jinja to embed command-line arguments directly into HTML reports without proper HTML escaping. This oversight allows an attacker to inject malicious HTML or JavaScript into the reports. When a victim opens the report in a browser, the injected JavaScript executes in the context of the report, potentially leading to data theft or session hijacking. The vulnerability affects Memray versions 1.19.1 and earlier, making it crucial for users to upgrade to the patched version to mitigate risks.
How To Fix
Minimum fixed version
1.19.2
This is the first release that contains the fix.
pip install --upgrade "memray==1.19.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using Memray with untrusted command-line arguments or scripts until you can upgrade to version 1.19.2. Additionally, consider sanitizing any command-line inputs to prevent potential XSS attacks.
Conclusion
In summary, CVE-2026-32722 is a stored XSS vulnerability in Memray that can lead to serious security issues if exploited. Users are strongly advised to upgrade to version 1.19.2 or later to protect against this vulnerability. Additionally, using Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for memray →
FAQ
The vulnerability is a stored cross-site scripting (XSS) issue that allows attackers to inject malicious scripts into Memray-generated HTML reports.
Memray versions 1.19.1 and earlier are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score of this vulnerability is 3.6, indicating a low severity level.
If you cannot upgrade immediately, avoid using Memray with untrusted command-line arguments and consider sanitizing inputs to mitigate potential risks.
