3.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-32722

CVE-2026-32722: Memray-generated HTML reports vulnerable to Stored XSS via unescaped command-line metadata

Memray is a memory profiler for Python. Prior to Memray 1.19.2, Memray rendered the command line of the tracked process directly into generated HTML reports without escaping. Because there was no escaping, attacker-controlled command line arguments were inserted as raw HTML into the generated report. This allowed JavaScript execution when a victim opened the generated report in a browser. Version 1.19.2 fixes the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-32722

CVE-2026-32722:

3.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
memray	pip	< 1.19.2	1.19.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic stored Cross-Site Scripting (XSS) issue within the HTML reports generated by Memray. The root cause is the failure to escape the command line of the profiled process, which is included in the report's metadata section. The fixing commit ba6e4e2e9930f9641bed7adfdf43c8e2545ce249 clearly shows the patch in the Jinja2 template src/memray/reporters/templates/base.html. The change from {{ metadata.command_line }} to {{ metadata.command_line|e }} adds the necessary HTML escaping.

The function responsible for orchestrating the report generation is render_report, located in the memray.reporters.templates module. This is confirmed by the new test case test_html_report_escaping added in tests/unit/test_templates.py, which directly calls render_report to test the fix. When an exploit occurs (i.e., a malicious report is generated), the render_report function would be present in the execution stack as it is responsible for processing the untrusted data (the command line) and passing it to the vulnerable template. Therefore, render_report is the key function to monitor for this vulnerability.

Vulnerable functions

render_report

src/memray/reporters/templates/__init__.py

The vulnerability lies within the Jinja2 template `src/memray/reporters/templates/base.html`. The `render_report` function renders this template, passing it `metadata` which contains the command line of the profiled process. The template directly rendered the `metadata.command_line` value without HTML escaping. An attacker who can control the command line arguments of the profiled program could inject malicious HTML and JavaScript. The `render_report` function is the entry point for generating the vulnerable HTML report.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.