PUBLISHED
2026-09-02 11:17
MODIFIED
2026-09-02 11:17
EPSS (Prob. Exploit)
0.41%
Top 65.3%
> DESCRIPTION
There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged to upgrade to Spark 3.5.8 or later.
This CVE is marked as "low" since the path to exploit requires both relatively high permissions (ability to launch a Spark job) and requires tricking a user with higher permissions to log in and visit the Spark history web page.
Users are encouraged to upgrade their Spark history servers to Spark 3.5.8 or later.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) - The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
> GITHUB SECURITY ADVISORY
GHSA-9437-39hj-3c93
MODERATE
Apache Spark History Server allows stored cross-site scripting through unescaped application names
AFFECTED PACKAGES:
MAVEN / org.apache.spark:spark-core_2.13
>= 3.0.0, < 3.5.8
Fixed in: 3.5.8
MAVEN / org.apache.spark:spark-core_2.12
>= 3.0.0, < 3.5.8
Fixed in: 3.5.8
PIP / pyspark
>= 3.0.0, < 3.5.8
Fixed in: 3.5.8
> HISTORIQUE DES MODIFICATIONS
Première apparition
02/09/2026 11:17
Source: NVD
📊
ENRICHISSEMENT
01/10/2026 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) - The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes spe...
Total des modifications: 1
Dernière mise à jour: 4 weeks ago