CVE-2026-32722 - Vulnerability Analysis

Overview

Memray < 1.19.2 contains a stored XSS caused by unescaped attacker-controlled command line arguments rendered in HTML reports, letting attackers execute JavaScript when victims open the report, exploit requires attacker control of command line arguments.

Severity & Score

Impact

Attackers can execute arbitrary JavaScript in victim's browser when opening the report, potentially leading to session hijacking or data theft.

Mitigation

Update to version 1.19.2 or later.

References

• https://github.com/bloomberg/memray/commit/ba6e4e2e9930f9641bed7adfdf43c8e2545ce249
• https://github.com/bloomberg/memray/releases/tag/v1.19.2
• https://github.com/bloomberg/memray/security/advisories/GHSA-r5pr-887v-m2w9

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner