CVE-2026-32773— Apache Spark: XSS Vulnerability in Spark Web 3.5.4
Quick assessment
Affected
Apache Software Foundation Apache Spark
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Spark 3.5.8 之前的 Spark History Server 中存在 XSS 转义缺失的问题，这使得恶意的 Spark 作业能够生成任意未转义的前端代码，从而可能导致浏览器中的最小权限提升。建议用户升级到 Spark 3.5.8 或更高版本。 该 CVE 被标记为“低”严重性，因为其利用路径需要同时满足两个条件：（1）攻击者需具备相对较高权限（即能够启动 Spark 作业）；（2）需要诱骗拥有更高权限的用户登录并访问 Spark 历史页面。 建议用户将 Spark History Server 升级
Possible ATT&CK Techniques 3 AI
T1204 · User Execution T1059.002 · AppleScript T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-32773
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Spark: XSS Vulnerability in Spark Web 3.5.4
Source: CVE Program / CVE List V5
Vulnerability Description
There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged to upgrade to Spark 3.5.8 or later.
This CVE is marked as "low" since the path to exploit requires both relatively high permissions (ability to launch a Spark job) and requires tricking a user with higher permissions to log in and visit the Spark history web page.
Users are encouraged to upgrade their Spark history servers to Spark 3.5.8 or later.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
Web页面中脚本相关HTML标签转义处理不恰当(基本跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Spark | 3.0.0 ~ 3.5.8 | - |
|
II. Public POCs for CVE-2026-32773
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-32773
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-32773 (1)
IV. Related Vulnerabilities
Same product: Apache Spark
-
CVE-2025-54920
Apache Spark: Spark History Server Code Execution Vulnerabil -
CVE-2025-55039
Apache Spark, Apache Spark: RPC encryption defaults to unaut -
CVE-2023-32007
Apache Spark: Shell command injection via Spark UI -
CVE-2023-22946
Apache Spark proxy-user privilege escalation from malicious -
CVE-2022-31777
Apache Spark XSS vulnerability in log viewer UI Javascript
Same vendor: Apache Software Foundation
-
CVE-2026-76986
Apache Wicket: XSS in AbstractSingleSelectChoice via getNull -
CVE-2026-76985
Apache Wicket: XSS in Palette via getAdditionalAttributes -
CVE-2026-76983
Apache Wicket: XSS in AutoLabelTextResolver via FormComponen -
CVE-2026-76984
Apache Wicket: XSS in MetaDataHeaderItem via addTagAttribute -
CVE-2026-76982
Apache Wicket: XSS in Button via its model object
Same weakness: CWE-80
-
CVE-2026-82838
Default webserver configuration with incorrect CSP -
CVE-2026-5218
HTML Injection in Softtr's E-Commerce Pack -
CVE-2026-5389
justhtml before 1.13.0 XSS via code fence breakout -
CVE-2026-35163
OctoPrint: XSS in Suppressed Command Notifications -
CVE-2026-73220
CVAT: Stored XSS via annotation guides in audio tasks
V. Comments for CVE-2026-32773
No comments yet