EUVD-2026-69899
GHSA-9437-39hj-3c93
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Requires job-submission privileges (PR:L), admin social engineering (AC:H, UI:R), and achieves only browser-scope impact on the victim session (S:C, C:L/I:L, A:N).
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
4Blast Radius
ecosystem impact- 6 pypi packages depend on pyspark (6 direct, 0 indirect)
Ecosystem-wide dependent count for version 3.0.0.
Description PRE-NVD
Articles & Coverage 2
AnalysisAI
Stored XSS in the Apache Spark History Server (versions 3.0.0 through 3.5.7) allows a user with Spark job submission rights to inject unsanitized HTML/JavaScript into the History Server web UI via the application name field (spark.app.name), which executes in the browser of any higher-privileged user who subsequently views that job's history page. Apache rates this low severity due to layered prerequisites - the attacker must hold job submission rights and socially engineer an administrator into visiting the History Server. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires both of the following conditions to be satisfied simultaneously: (1) The attacker must hold Spark job submission permissions on the cluster - this is a privileged operation typically granted only to data engineers, data scientists, or pipeline operators, not arbitrary network users. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Apache's self-assessment of Low severity is well-calibrated to the real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: Apache Spark 3.5.8. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Apache Spark instances running versions 3.0.0 through 3.5.7 and identify which have History Server web UI enabled; restrict Spark job submission rights to trusted personnel only and limit History Server access to necessary administrators. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. Rated high sev
In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (s
An issue was discovered in Ignite Realtime Spark 2.8.3 (and the ROAR plugin for it) on Windows. Rated high severity (CVS
Directory traversal vulnerability in Spark 2.5 allows remote attackers to read arbitrary files via a .. Rated high sever
From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the su
Signing cookies is an application security feature that adds a digital signature to cookie data to verify its authentici
In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting
In all versions of Apache Spark, its standalone resource manager accepts code to execute on a 'master' host, that then r
In Apache Spark 2.1.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, it's possible for a malicious user to construct a URL pointin
** UNSUPPORTED WHEN ASSIGNED ** The Apache Spark UI offers the possibility to enable ACLs via the configuration option s
In Apache Spark 1.6.0 until 2.1.1, the launcher API performs unsafe deserialization of data received by its socket. Rate
The REST interface in Cisco Spark 2015-07-04 allows remote attackers to bypass intended access restrictions and create a
Same weakness CWE-80 – Basic XSS
View allShare
External POC / Exploit Code
Leaving vuln.today