CVE-2026-32773
published 2026-09-02CVE-2026-32773: There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code…
PriorityP432medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.68%
50.7th percentile
There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged to upgrade to Spark 3.5.8 or later.
This CVE is marked as "low" since the path to exploit requires both relatively high permissions (ability to launch a Spark job) and requires tricking a user with higher permissions to log in and visit the Spark history web page.
Users are encouraged to upgrade their Spark history servers to Spark 3.5.8 or later.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | spark | >= 3.0.0 < 3.5.8 | 3.5.8 |
| apache_software_foundation | apache_spark | >= 3.0.0 < 3.5.8 | 3.5.8 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Apache Spark 3.5.4 cross site scripting
vuldb·2026-09-02
CVE-2026-32773 [LOW] Apache Spark 3.5.4 cross site scripting
A vulnerability was found in Apache Spark 3.5.4. It has been classified as problematic. This affects an unknown function. The manipulation leads to cross site scripting.
This vulnerability is referenced as CVE-2026-32773. Remote exploitation of the attack is possible. No exploit is available.
GHSA
There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege esca
ghsa_unreviewed·2026-09-02
CVE-2026-32773 [MEDIUM] CWE-80 There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege esca
There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged to upgrade to Spark 3.5.8 or later.
This CVE is marked as "low" since the path to exploit requires both relatively high permissions (ability to launch a Spark job) and requires tricking a user with higher permissions to log in and visit the Spark history web page.
Users are encouraged to upgrade their Spark history servers to Spark 3.5.8 or later.
No detection rules found.
No public exploits indexed.
2026-09-02
Published