CVE-2026-32773
Published:September 02, 2026
Updated:September 22, 2026
There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged to upgrade to Spark 3.5.8 or later.
This CVE is marked as "low" since the path to exploit requires both relatively high permissions (ability to launch a Spark job) and requires tricking a user with higher permissions to log in and visit the Spark history web page.
Users are encouraged to upgrade their Spark history servers to Spark 3.5.8 or later.
Affected Packages
https://github.com/apache/spark.git (GITHUB):
Affected version(s) >=v3.0.0 <v3.5.8Fix Suggestion:
Update to version v3.5.8org.apache.spark:spark-core_2.13 (JAVA):
Affected version(s) >=3.2.0 <3.5.8Fix Suggestion:
Update to version 3.5.8org.apache.spark:spark-core_2.12 (JAVA):
Affected version(s) >=3.0.0 <3.5.8Fix Suggestion:
Update to version 3.5.8Related Resources (3)
Do you need more information?
Contact UsCVSS v4
Base Score:
5.3
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
PASSIVE
Vulnerable System Confidentiality
LOW
Vulnerable System Integrity
LOW
Vulnerable System Availability
NONE
Subsequent System Confidentiality
LOW
Subsequent System Integrity
LOW
Subsequent System Availability
NONE
CVSS v3
Base Score:
6.1
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE
Weakness Type (CWE)
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
EPSS
Base Score:
0.67