CVE-2026-41206

HighCVSS 7.8/10Last modified Oct 26, 2026

Description

PySpector is a static analysis security testing (SAST) Framework engineered for modern Python development workflows. The plugin security validator in PySpector uses AST-based static analysis to prevent dangerous code from being loaded as plugins. Prior to version 0.1.8, the blocklist implemented in `PluginSecurity.validate_plugin_code` is incomplete and can be bypassed using several Python constructs that are not checked. An attacker who can supply a plugin file can achieve arbitrary code execution within the PySpector process when that plugin is installed and executed. Version 0.1.8 fixes the issue.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-184

Affected software

Vendor	Product	Versions
ParzivalHack	PySpector	< 0.1.8

References

https://github.com/ParzivalHack/PySpector/commit/3c9547157fc07396f22b26b3484a9a91eba98555Patch
https://github.com/ParzivalHack/PySpector/commit/4e279e078c53d760fd321ff9b698d683c65ccb8ePatch
https://github.com/ParzivalHack/PySpector/security/advisories/GHSA-vp22-38m5-r39rExploit, Vendor Advisory
https://github.com/ParzivalHack/PySpector/security/advisories/GHSA-vp22-38m5-r39rExploit, Vendor Advisory

Timeline

Published: Apr 23, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-412075.3The netty incubator codec.bhttp is a java language binary http parser. Prior to version 0.0.21.Final, HKDF_expand returns non-NULL on failur CVE-2026-412088.8Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Versions of @paperclipai/server prior to CVE-2026-41214.3The Kcaptcha plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.0.1. This is due to miss CVE-2026-412106.5Moonlight Qt is a GameStream client for Windows, macOS, Linux, and Steam Link. In version 6.1.0 and earlier, after a victim initiates a stre CVE-2026-4121110.0Vite+ is a unified toolchain and entry point for web development. Prior to version 0.1.17, `downloadPackageManager()` accepts an untrusted `CVE-2026-412135.9@node-oauth/oauth2-server is a module for implementing an OAuth2 server in Node.js. The token exchange path accepts RFC7636-invalid code_ver CVE-2026-412144.8Improper input validation for some Intel(R) Neural Compressor software before version 3.8 within Ring 3: User Applications may allow a denia CVE-2026-412167.5An invalid pointer dereference vulnerability exists in the vtkPNGReader::ExecuteInformation functionality of vtk 9.6. A specially crafted .p CVE-2026-412177.9A vulnerability exists in an undisclosed BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with resource administrat CVE-2026-412187.5When BIG-IP PEM iRules are configured on a virtual server (iRules using commands starting with CLASSIFICATION::, CLASSIFY::, PEM::, PSC::, a CVE-2026-412196.5An improper sanitization vulnerability exists in the BIG-IP QKView utility that allows a low-privileged attacker to read sensitive informati CVE-2026-412207.8Local privilege escalation due to improper input validation. The following products are affected: Acronis DeviceLock DLP (Windows) before bu