Is CVE-2026-33140 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33140 being exploited in the wild.

How severe is CVE-2026-33140?

Medium severity, with a CVSS score of 4, published 13 July 2026.

Which products and versions are affected?

pyspector (PyPI) ECOSYSTEM:introduced=0,fixed=0.1.7.

Is there a fix for CVE-2026-33140?

Yes. pyspector (PyPI): upgrade to 0.1.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-33140 attacked?

It is attacked over the network.

Am I affected by CVE-2026-33140?

Check whether you run pyspector (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33140: PYSEC-2026-3029 - Stored XSS in PySpector HTML Report Generation leads to Javascript Code Execution

CVE-2026-33140 · Severity: medium · CVSS 4 · Published 2026-07-13

PySpector is a Python code analysis tool that generates HTML reports highlighting code quality issues. A stored cross-site scripting vulnerability in the HTML report generator allows malicious JavaScript embedded in scanned Python files to execute in a user's browser when they open the generated report. An attacker could craft a malicious Python file, trick a user into scanning it, and then execute arbitrary JavaScript in their browser to manipulate content, redirect to phishing sites, or steal local files.

Technologies: pyspector (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-33140 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33140 being exploited in the wild.
How severe is CVE-2026-33140?: Medium severity, with a CVSS score of 4, published 13 July 2026.
Which products and versions are affected?: pyspector (PyPI) ECOSYSTEM:introduced=0,fixed=0.1.7.
Is there a fix for CVE-2026-33140?: Yes. pyspector (PyPI): upgrade to 0.1.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33140 attacked?: It is attacked over the network.
Am I affected by CVE-2026-33140?: Check whether you run pyspector (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pyspector (PyPI): upgrade to 0.1.7 or later
```
pip install "pyspector>=0.1.7"
```

Technical details

PySpector versions ≤0.1.6 contain a stored XSS vulnerability (CWE-79) in the HTML report generator. When scanning a Python file containing JavaScript payloads (e.g., within string arguments to eval()), the flagged code snippet is interpolated into the generated HTML report without sanitization. The attack requires a user to scan an attacker-controlled Python file and open the resulting HTML report in a browser. While the file:// origin context limits exfiltration of credentials, an attacker can still achieve DOM manipulation, redirect attacks, and potential theft of locally accessible data via file:// fetch requests. The vulnerability has been patched in version 0.1.7.

Affected products

PySpector PySpector ≤0.1.6

Identifiers

CVE-2026-33140
GHSA-2gmv-2r3v-jxj2
PYSEC-2026-3029

Timeline

2026-03-18: disclosed
2026-03-18: patched: Fixed in version 0.1.7

References

https://github.com/ParzivalHack/PySpector/security/advisories/GHSA-2gmv-2r3v-jxj2

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.