Every CVE Search/ Get API key

CVE-2026-32773

Apache Spark: XSS Vulnerability in Spark Web 3.5.4

6.1 MediumFix available

There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged to upgrade to Spark 3.5.8 or later.

This CVE is marked as "low" since the path to exploit requires both relatively high permissions (ability to launch a Spark job) and requires tricking a user with higher permissions to log in and visit the Spark history web page.

Users are encouraged to upgrade their Spark history servers to Spark 3.5.8 or later.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.41%Up 0.2 points since Sep 3, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.1

Apache Spark: XSS Vulnerability in Spark Web 3.5.4

There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged to upgrade to Spark 3.5.8 or later.

This CVE is marked as "low" since the path to exploit requires both relatively high permissions (ability to launch a Spark job) and requires tricking a user with higher permissions to log in and visit the Spark history web page.

Users are encouraged to upgrade their Spark history servers to Spark 3.5.8 or later.

Record
CVE-2026-32773
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-80
Updated
2026-11-02
EUVDEUVD-2026-69899 6.1

There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged to upgrade to Spark 3.5.8 or later.

This CVE is marked as "low" since the path to exploit requires both relatively high permissions (ability to launch a Spark job) and requires tricking a user with higher permissions to log in and visit the Spark history web page.

Users are encouraged to upgrade their Spark history servers to Spark 3.5.8 or later.

Record
EUVD-2026-69899
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-9437-39hj-3c93 6.1

Apache Spark History Server allows stored cross-site scripting through unescaped application names

There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged to upgrade to Spark 3.5.8 or later.

This CVE is marked as "low" since the path to exploit requires both relatively high permissions (ability to launch a Spark job) and requires tricking a user with higher permissions to log in and visit the Spark history web page.

Users are encouraged to upgrade their Spark history servers to Spark 3.5.8 or later.

Record
GHSA-9437-39hj-3c93
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-80
Updated
2026-11-02
NVD 6.1

There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged to upgrade to Spark 3.5.8 or later.

This CVE is marked as "low" since the path to exploit requires both relatively high permissions (ability to launch a Spark job) and requires tricking a user with higher permissions to log in and visit the Spark history web page.

Users are encouraged to upgrade their Spark history servers to Spark 3.5.8 or later.

Record
CVE-2026-32773
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-80
Updated
2026-11-02
OSV 6.1

Apache Spark: XSS Vulnerability in Spark Web 3.5.4

There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged to upgrade to Spark 3.5.8 or later.

This CVE is marked as "low" since the path to exploit requires both relatively high permissions (ability to launch a Spark job) and requires tricking a user with higher permissions to log in and visit the Spark history web page.

Users are encouraged to upgrade their Spark history servers to Spark 3.5.8 or later.

Record
CVE-2026-32773
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-80
Updated
2026-11-02
OSVGHSA-9437-39hj-3c93 6.1

Apache Spark History Server allows stored cross-site scripting through unescaped application names

There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged to upgrade to Spark 3.5.8 or later.

This CVE is marked as "low" since the path to exploit requires both relatively high permissions (ability to launch a Spark job) and requires tricking a user with higher permissions to log in and visit the Spark history web page.

Users are encouraged to upgrade their Spark history servers to Spark 3.5.8 or later.

Record
GHSA-9437-39hj-3c93
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-80
Updated
2026-11-02
OSVPYSEC-2026-3966 6.1

There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged to upgrade to Spark 3.5.8 or later.

This CVE is marked as "low" since the path to exploit requires both relatively high permissions (ability to launch a Spark job) and requires tricking a user with higher permissions to log in and visit the Spark history web page.

Users are encouraged to upgrade their Spark history servers to Spark 3.5.8 or later.

Record
PYSEC-2026-3966
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVBIT-spark-2026-32773 No score

Apache Spark: XSS Vulnerability in Spark Web 3.5.4

There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged to upgrade to Spark 3.5.8 or later.

This CVE is marked as "low" since the path to exploit requires both relatively high permissions (ability to launch a Spark job) and requires tricking a user with higher permissions to log in and visit the Spark history web page.

Users are encouraged to upgrade their Spark history servers to Spark 3.5.8 or later.

Record
BIT-spark-2026-32773
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
pyspark
PyPI
 3.0.0 up to 3.5.8
3.5.8
org.apache.spark:spark-core_2.12
Maven
 3.0.0 up to 3.5.8
3.5.8
org.apache.spark:spark-core_2.13
Maven
 3.0.0 up to 3.5.8
3.5.8
spark
Bitnami
 3.0.0 up to 3.5.8
3.5.8
pyspark
PyPI
 3.0.0 up to 3.5.8, plus listed versions
3.0.13.0.23.0.33.1.13.1.2
Show 24 moreShow less
3.1.33.2.03.2.13.2.23.2.33.2.43.3.03.3.13.3.23.3.33.3.43.4.03.4.13.4.23.4.33.4.43.5.03.5.13.5.23.5.33.5.43.5.53.5.63.5.7
3.5.8
org.apache.spark:spark-core_2.12
Maven
 3.0.0 up to 3.5.8, plus listed versions
3.0.0-preview3.0.0-preview23.0.13.0.23.0.3
Show 27 moreShow less
3.1.03.1.13.1.23.1.33.2.03.2.13.2.23.2.33.2.43.3.03.3.13.3.23.3.33.3.43.4.03.4.13.4.23.4.33.4.43.5.03.5.13.5.23.5.33.5.43.5.53.5.63.5.7
3.5.8
org.apache.spark:spark-core_2.13
Maven
 3.0.0 up to 3.5.8, plus listed versions
3.2.03.2.13.2.23.2.33.2.4
Show 18 moreShow less
3.3.03.3.13.3.23.3.33.3.43.4.03.4.13.4.23.4.33.4.43.5.03.5.13.5.23.5.33.5.43.5.53.5.63.5.7
3.5.8

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-32773 is a medium vulnerability (CVSS 6.1) in Apache Spark, published September 2, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 36th percentile. Fixed in pyspark 3.5.8.

References

Show 6 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open