CVE-2026-41206

What it is

PySpector is a static analysis security testing (SAST) Framework engineered for modern Python development workflows. The plugin security validator in PySpector uses AST-based static analysis to prevent dangerous code from being loaded as plugins. Prior to version 0.1.8, the blocklist implemented in `PluginSecurity.validate_plugin_code` is incomplete and can be bypassed using several Python constructs that are not checked. An attacker who can supply a plugin file can achieve arbitrary code execution within the PySpector process when that plugin is installed and executed. Version 0.1.8 fixes the issue.

At a glance

Exploitability

Can be exploited locally on the machine with a low-privilege account, but needs a user to act. High risk of data exposure, data tampering.

Exploit odds

0.2% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-04-23 02:16 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-10-26 21:10 UTC Last updatedMost recent change to the record

Details

Published

2026-04-23 02:16 UTC

Last modified

2026-10-26 21:10 UTC

Exploit probability

0.2% · EPSS, next 30 days

Weakness

CWE-184

Record status

Analyzed

Affected

• Parzivalhack Pyspector < 0.1.8

Attack profile CVSS 4.0 · 6.9

Attack vector

Local

Complexity

Low

Attack requirements

None

Privileges needed

Low

User interaction

Active

Confidentiality

High

Integrity

High

Availability

Low