8.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-33139

CVE-2026-33139: PySpector: Plugin Sandbox Bypass leads to Arbitrary Code Execution

PySpector is a static analysis security testing (SAST) Framework engineered for modern Python development workflows. PySpector versions 0.1.6 and prior are affected by a security validation bypass in the plugin system. The validate_plugin_code() function in plugin_system.py, performs static AST analysis to block dangerous API calls before a plugin is trusted and executed. However, the internal resolve_name() helper only handles ast.Name and ast.Attribute node types, returning None for all others. When a plugin uses indirect function calls via getattr() (such as getattr(os, 'system')) the outer call's func node is of type ast.Call, causing resolve_name() to return None, and the security check to be silently skipped. The plugin incorrectly passes the trust workflow, and executes arbitrary system commands on the user's machine when loaded. This issue has been patched in version 0.1.7.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-33139

CVE-2026-33139:

8.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pyspector	pip	<= 0.1.6	0.1.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a sandbox bypass in PySpector's plugin system. The validate_plugin_code function in src/pyspector/plugin_system.py is intended to prevent plugins from executing dangerous code by performing static analysis on the plugin's abstract syntax tree (AST). However, the resolve_name helper function, which validate_plugin_code relies on, did not correctly handle all types of AST nodes. Specifically, it did not process ast.Call nodes. This allowed an attacker to craft a malicious plugin that uses getattr() to make an indirect call to a dangerous function (e.g., getattr(os, 'system')). Because the outer node is an ast.Call for getattr, resolve_name would return None, and the security check would be silently bypassed. The plugin would then be incorrectly marked as safe, and upon execution, it would run with the full permissions of the user, leading to arbitrary code execution. The patch addresses this by updating resolve_name to handle ast.Call nodes and by explicitly adding getattr to the list of dangerous calls in validate_plugin_code.

Vulnerable functions

validate_plugin_code

src/pyspector/plugin_system.py

This function is responsible for validating plugin code before execution. The vulnerability lies in its incomplete list of dangerous calls, which allowed a bypass using `getattr`. The patch adds `getattr` to the list of `DANGEROUS_CALLS` to prevent this bypass.

resolve_name

src/pyspector/plugin_system.py

This helper function, used by `validate_plugin_code`, was unable to resolve function names from `ast.Call` nodes. This meant that indirect calls like `getattr(os, 'system')` were not detected as dangerous. The patch adds logic to recursively resolve the function being called within an `ast.Call` node, closing the loophole.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.