CVE-2026-32773BIT-spark-2026-32773GHSA-9437-39hj-3c93PYSEC-2026-3966

pyspark: Apache Spark History Server allows stored cross-site scripting through unescaped application names

Apache Software Foundation pysparkpipLibraries & packages

CVSS

6.1Medium

ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV

Exploit odds (EPSS)0.41%Chance of exploitation activity in the next 30 days, higher than 34% of CVEs. Scored 23 Oct 2026FIRST EPSS

Fixed in3.5.8Fixed versionGitHub

Published2 Sep 2026Updated 5 Oct 2026CVE List

What fixes it

3.5.8pyspark, pipGitHub
3.5.8org.apache.spark:spark-core_2.12, mavenGitHub<dependency><groupId>org.apache.spark</groupId><artifactId>spark-core_2.12</artifactId><version>3.5.8</version></dependency>
3.5.8org.apache.spark:spark-core_2.13, mavenGitHub<dependency><groupId>org.apache.spark</groupId><artifactId>spark-core_2.13</artifactId><version>3.5.8</version></dependency>
3.5.8Apache SparkCVE List
3.5.8pyspark, PyPIOSVpip install "pyspark>=3.5.8"
3.5.8org.apache.spark:spark-core_2.12, MavenOSV<dependency><groupId>org.apache.spark</groupId><artifactId>spark-core_2.12</artifactId><version>3.5.8</version></dependency>

Show all 7 fixed versions

3.5.8org.apache.spark:spark-core_2.13, MavenOSV<dependency><groupId>org.apache.spark</groupId><artifactId>spark-core_2.13</artifactId><version>3.5.8</version></dependency>

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged to upgrade to Spark 3.5.8 or later.

This CVE is marked as "low" since the path to exploit requires both relatively high permissions (ability to launch a Spark job) and requires tricking a user with higher permissions to log in and visit the Spark history web page.

Users are encouraged to upgrade their Spark history servers to Spark 3.5.8 or later.

Text from GitHub Advisory Database

Affected versions 93

pyspark, pip>= 3.0.0, < 3.5.8GitHub
org.apache.spark:spark-core_2.12, maven>= 3.0.0, < 3.5.8GitHub
org.apache.spark:spark-core_2.13, maven>= 3.0.0, < 3.5.8GitHub
Apache Sparkaffected: 3.0.0 before 3.5.8CVE List
pyspark, PyPIfrom 3.0.0, fixed in 3.5.8OSV
pyspark, PyPI3.0.0OSV
pyspark, PyPI3.0.1OSV
pyspark, PyPI3.0.2OSV
pyspark, PyPI3.0.3OSV
pyspark, PyPI3.1.1OSV
pyspark, PyPI3.1.2OSV
pyspark, PyPI3.1.3OSV
pyspark, PyPI3.2.0OSV
pyspark, PyPI3.2.1OSV
pyspark, PyPI3.2.2OSV
pyspark, PyPI3.2.3OSV
pyspark, PyPI3.2.4OSV
pyspark, PyPI3.3.0OSV
pyspark, PyPI3.3.1OSV
pyspark, PyPI3.3.2OSV
pyspark, PyPI3.3.3OSV
pyspark, PyPI3.3.4OSV
pyspark, PyPI3.4.0OSV
pyspark, PyPI3.4.1OSV
pyspark, PyPI3.4.2OSV
pyspark, PyPI3.4.3OSV
pyspark, PyPI3.4.4OSV
pyspark, PyPI3.5.0OSV
pyspark, PyPI3.5.1OSV
pyspark, PyPI3.5.2OSV
pyspark, PyPI3.5.3OSV
pyspark, PyPI3.5.4OSV
pyspark, PyPI3.5.5OSV
pyspark, PyPI3.5.6OSV
pyspark, PyPI3.5.7OSV
org.apache.spark:spark-core_2.12, Mavenfrom 3.0.0, fixed in 3.5.8OSV
org.apache.spark:spark-core_2.12, Maven3.0.0OSV
org.apache.spark:spark-core_2.12, Maven3.0.0-previewOSV
org.apache.spark:spark-core_2.12, Maven3.0.0-preview2OSV
org.apache.spark:spark-core_2.12, Maven3.0.1OSV
org.apache.spark:spark-core_2.12, Maven3.0.2OSV
org.apache.spark:spark-core_2.12, Maven3.0.3OSV
org.apache.spark:spark-core_2.12, Maven3.1.0OSV
org.apache.spark:spark-core_2.12, Maven3.1.1OSV
org.apache.spark:spark-core_2.12, Maven3.1.2OSV
org.apache.spark:spark-core_2.12, Maven3.1.3OSV
org.apache.spark:spark-core_2.12, Maven3.2.0OSV
org.apache.spark:spark-core_2.12, Maven3.2.1OSV
org.apache.spark:spark-core_2.12, Maven3.2.2OSV
org.apache.spark:spark-core_2.12, Maven3.2.3OSV
org.apache.spark:spark-core_2.12, Maven3.2.4OSV
org.apache.spark:spark-core_2.12, Maven3.3.0OSV
org.apache.spark:spark-core_2.12, Maven3.3.1OSV
org.apache.spark:spark-core_2.12, Maven3.3.2OSV
org.apache.spark:spark-core_2.12, Maven3.3.3OSV
org.apache.spark:spark-core_2.12, Maven3.3.4OSV
org.apache.spark:spark-core_2.12, Maven3.4.0OSV
org.apache.spark:spark-core_2.12, Maven3.4.1OSV
org.apache.spark:spark-core_2.12, Maven3.4.2OSV
org.apache.spark:spark-core_2.12, Maven3.4.3OSV
org.apache.spark:spark-core_2.12, Maven3.4.4OSV
org.apache.spark:spark-core_2.12, Maven3.5.0OSV
org.apache.spark:spark-core_2.12, Maven3.5.1OSV
org.apache.spark:spark-core_2.12, Maven3.5.2OSV
org.apache.spark:spark-core_2.12, Maven3.5.3OSV
org.apache.spark:spark-core_2.12, Maven3.5.4OSV
org.apache.spark:spark-core_2.12, Maven3.5.5OSV
org.apache.spark:spark-core_2.12, Maven3.5.6OSV
org.apache.spark:spark-core_2.12, Maven3.5.7OSV
org.apache.spark:spark-core_2.13, Mavenfrom 3.0.0, fixed in 3.5.8OSV
org.apache.spark:spark-core_2.13, Maven3.2.0OSV
org.apache.spark:spark-core_2.13, Maven3.2.1OSV
org.apache.spark:spark-core_2.13, Maven3.2.2OSV
org.apache.spark:spark-core_2.13, Maven3.2.3OSV
org.apache.spark:spark-core_2.13, Maven3.2.4OSV
org.apache.spark:spark-core_2.13, Maven3.3.0OSV
org.apache.spark:spark-core_2.13, Maven3.3.1OSV
org.apache.spark:spark-core_2.13, Maven3.3.2OSV
org.apache.spark:spark-core_2.13, Maven3.3.3OSV
org.apache.spark:spark-core_2.13, Maven3.3.4OSV
org.apache.spark:spark-core_2.13, Maven3.4.0OSV
org.apache.spark:spark-core_2.13, Maven3.4.1OSV
org.apache.spark:spark-core_2.13, Maven3.4.2OSV
org.apache.spark:spark-core_2.13, Maven3.4.3OSV
org.apache.spark:spark-core_2.13, Maven3.4.4OSV
org.apache.spark:spark-core_2.13, Maven3.5.0OSV
org.apache.spark:spark-core_2.13, Maven3.5.1OSV
org.apache.spark:spark-core_2.13, Maven3.5.2OSV
org.apache.spark:spark-core_2.13, Maven3.5.3OSV
org.apache.spark:spark-core_2.13, Maven3.5.4OSV
org.apache.spark:spark-core_2.13, Maven3.5.5OSV
org.apache.spark:spark-core_2.13, Maven3.5.6OSV
org.apache.spark:spark-core_2.13, Maven3.5.7OSV

pyspark: Apache Spark History Server allows stored cross-site scripting through unescaped application names

What fixes it

Description

Affected versions 93

References 8