Executive brief
Spark History Server is a web interface that displays information about completed Apache Spark jobs. A vulnerability allows a malicious job to inject unescaped HTML and JavaScript into the history page, potentially allowing an attacker with job-submission privileges to perform actions on behalf of a user with higher privileges who visits the history page. This could lead to unauthorized changes to Spark cluster configuration or job submission.
Technical details
The Spark History Server fails to properly escape user-supplied input (likely from Spark job names or configuration) when rendering it in the web frontend, allowing Cross-Site Scripting (XSS) injection. An attacker with permissions to submit Spark jobs can craft a malicious job name containing JavaScript code that executes in the browser of any administrator or high-privilege user who views the Spark History Server web interface. This requires the attacker to have job-submission privileges and a victim with higher permissions to visit the affected page. The vulnerability is fixed in Spark 3.5.8 and later versions.
Affected products
- Apache Spark before 3.5.8
Timeline
- 2026-09-02: disclosed