CVE-2026-32722CWE-79

Memray-generated HTML reports vulnerable to Stored XSS via unescaped command-line metadata

Low · published March 18, 2026

CVSS v3.1
3.6
EPSS
0%
Percentile
29.2
In the wild
Unconfirmed
What it is

Memray is a memory profiler for Python. Prior to Memray 1.19.2, Memray rendered the command line of the tracked process directly into generated HTML reports without escaping. Because there was no escaping, attacker-controlled command line arguments were inserted as raw HTML into the generated report. This allowed JavaScript execution when a victim opened the generated report in a browser. Version 1.19.2 fixes the issue.

The record
Technical detail
CVSS v3.1
3.6 · LOW
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00365 · 29.2th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-03-18T21:25Z
EPSS history
Timeline
  • 18 MAR 21:25Z
    Memray-generated HTML reports vulnerable to Stored XSS via unescaped command-line metadata
    cvelistv5