Cross-Site Scripting

Apache Spark is vulnerable to Cross-Site Scripting. The vulnerability is due to a lack of XSS escaping in the Spark History Server, where a malicious Spark job can generate arbitrary unescaped frontend code and lead to a minimal privilege escalation in the browser when a higher‑privileged user...

CVE-2026-32773

There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged to upgrade to Spark 3.5.8 or later. This CVE is marked as...

EUVD-2026-69899

There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged to upgrade to Spark 3.5.8 or later. This CVE is marked as...

CVE-2026-32773: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged to upgrade to Spark 3.5.8 or later. This CVE is marked as...

PT-2026-84664

Name of the Vulnerable Software and Affected Versions Spark History Server versions prior to 3.5.8 Description Insufficient XSS escaping allows a malicious Spark job to generate arbitrary unescaped frontend code. This can lead to a minimal privilege escalation within the browser. Exploitation...