5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-33140

CVE-2026-33140: PySpector: Stored XSS in PySpector HTML Report Generation leads to Javascript Code Execution

PySpector is a static analysis security testing (SAST) Framework engineered for modern Python development workflows. PySpector versions 0.1.6 and prior are affected by a stored Cross-Site Scripting (XSS) vulnerability in the HTML report generator. When PySpector scans a Python file containing JavaScript payloads (i.e. inside a string passed to eval() ), the flagged code snippet is interpolated into the HTML report without sanitization. Opening the generated report in a browser causes the embedded JavaScript to execute in the browser's local file context. This issue has been patched in version 0.1.7.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-33140

CVE-2026-33140:

5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pyspector	pip	<= 0.1.6	0.1.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability described is a classic stored Cross-Site Scripting (XSS) issue within the HTML report generation feature of PySpector. The core of the problem lies in the failure to sanitize data that is extracted from a scanned Python file before embedding it into the final HTML report. An attacker could craft a Python file with malicious JavaScript payloads in strings, which, when scanned, would be included raw in the report. When a user opens this report, the browser executes the malicious script.

To pinpoint the exact vulnerable function, I first identified the repository and the patched version from the advisory. By comparing the git tags for the last vulnerable version (v0.1.6-beta) and the first patched version (v0.1.7-beta), I located the specific commit that addressed the vulnerability. The commit 6b4979fb6383193f5f3d3e30bab4ef62a3375981 with the message "Fix: Added HTML module escaping" clearly indicates the nature of the fix.

Analyzing the diff of this commit reveals that the file src/pyspector/reporting.py was modified. Inside this file, the to_html method of the Report class was changed to wrap several variables (issue.file_path, issue.severity, issue.description, and issue.code) with html_module.escape(). This is the standard Python defense against XSS, confirming that this function was the source of the vulnerability. Therefore, pyspector.reporting.Report.to_html is the vulnerable function that would appear in a runtime profile during the generation of a malicious report.

Vulnerable functions

pyspector.reporting.Report.to_html

src/pyspector/reporting.py

The `to_html` function in the `Report` class was vulnerable to stored XSS. It directly interpolated potentially malicious data from a scanned Python file (specifically, the file path, issue severity, description, and the code snippet itself) into an HTML report without proper sanitization. The patch applies `html.escape` to these fields, which neutralizes any embedded HTML or JavaScript.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.