CVE-2026-33140: Stored XSS Vulnerability in PySpector HTML Report Generation
Summary
CVE-2026-33140: Stored XSS in PySpector HTML Report Generation leads to Javascript Code Execution. Affects pyspector versions < 0.1.7. Fixed in 0.1.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
PySpector is a Python tool designed to analyze Python code and generate detailed HTML reports highlighting potential issues. It is particularly useful for developers looking to improve code quality and security. However, versions up to 0.1.6 are vulnerable to a stored Cross-Site Scripting (XSS) attack, which can lead to the execution of arbitrary JavaScript code when the generated reports are opened in a web browser.
Vulnerability Detail
The vulnerability arises from the way PySpector handles JavaScript payloads embedded in Python strings. When a Python file containing such payloads is scanned, the flagged code is inserted into the HTML report without proper sanitization. This allows an attacker to craft a malicious Python file that, when scanned, results in an HTML report that executes JavaScript in the user's browser. The implications include arbitrary DOM manipulation, redirects to malicious sites, and potential theft of locally accessible data through browser requests.
How To Fix
Minimum fixed version
0.1.7
This is the first release that contains the fix.
pip install --upgrade "pyspector==0.1.7"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users should avoid scanning untrusted Python files with PySpector until they have updated to the patched version. Additionally, users can manually review the generated HTML reports for any suspicious content before opening them in a browser.
Conclusion
The stored XSS vulnerability in PySpector's HTML report generation poses a significant risk to users who scan untrusted Python files. It is crucial to update to version 0.1.7 or later to mitigate this risk. Users should also exercise caution when handling generated reports.
See every vulnerability recorded for pyspector →
FAQ
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The risks include arbitrary JavaScript execution in the user's browser, which can lead to data theft, redirection to malicious sites, and unauthorized manipulation of the DOM.
Yes, avoid scanning untrusted Python files and review HTML reports for suspicious content before opening them in a browser.
PySpector versions up to and including 0.1.6 are affected by this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for pyspector.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
