Is CVE-2024-37063 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-37063 being exploited in the wild.

How severe is CVE-2024-37063?

Low severity, with a CVSS score of 3.1, published 7 July 2026.

Which products and versions are affected?

ydata-profiling (PyPI) ECOSYSTEM:introduced=3.7.0,last_affected=4.8.3.

Is there a fix for CVE-2024-37063?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2024-37063 attacked?

It is attacked with local access or from the adjacent network.

Am I affected by CVE-2024-37063?

Check whether you run ydata-profiling (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-37063: PYSEC-2026-2060 - ydata cross-site scripting

CVE-2024-37063 · Severity: low · CVSS 3.1 · Published 2026-07-07

Ydata's ydata-profiling library is a data analysis tool that generates HTML reports for exploring Pandas and Spark DataFrames. A cross-site scripting (XSS) vulnerability allows attackers to inject and execute malicious JavaScript code when users view a crafted report in their browser, potentially enabling account compromise, data theft, or malware distribution.

Technologies: ydata-profiling (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2024-37063 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-37063 being exploited in the wild.
How severe is CVE-2024-37063?: Low severity, with a CVSS score of 3.1, published 7 July 2026.
Which products and versions are affected?: ydata-profiling (PyPI) ECOSYSTEM:introduced=3.7.0,last_affected=4.8.3.
Is there a fix for CVE-2024-37063?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2024-37063 attacked?: It is attacked with local access or from the adjacent network.
Am I affected by CVE-2024-37063?: Check whether you run ydata-profiling (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a DOM-based or stored XSS flaw (CWE-79) in ydata-profiling versions 3.7.0 through 4.8.3 that fails to properly sanitize user-controlled or malicious input when generating HTML reports. An attacker can craft a malicious report file that, when viewed in a browser, executes arbitrary JavaScript code with the privileges of the user viewing the report. The attack requires user interaction (opening the report) and local or adjacent network access to deliver the malicious file. The impact includes confidentiality, integrity, and availability compromise. A patch is expected in versions after 4.8.3.

Affected products

Ydata ydata-profiling 3.7.0 through 4.8.3

Identifiers

CVE-2024-37063
GHSA-2r57-2mrh-ggjv
PYSEC-2026-2060

Timeline

2024-06-04: disclosed
2024-06-05: advisory: GitHub security review completed

References

https://github.com/ydataai/ydata-profiling

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.