Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Loading CVE intelligence

Loading vulnerability catalog

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

Tool Directory

CVE-2026-32722

MediumPublished

Memray-generated HTML reports vulnerable to Stored XSS via unescaped command-line metadata

Published: Mar 18, 2026
Updated: Mar 19, 2026
Assigning CNA: GitHub_M
Evidence observed: Aug 18, 2026

Primary CVSS

6.1/ 10Medium

nvd · CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS probability estimate

0.3%

Low · next 30 days

Percentile: 23.1%
Model date: Sep 21, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

Summary

Memray is a memory profiler for Python. Prior to Memray 1.19.2, Memray rendered the command line of the tracked process directly into generated HTML reports without escaping. Because there was no escaping, attacker-controlled command line arguments were inserted as raw HTML into the generated report. This allowed JavaScript execution when a victim opened the generated report in a browser. Version 1.19.2 fixes the issue.

Sources

CVE-2026-32722PoC
Bloomberg Memray’s Stored XSS via Unescaped Command-Line Metadata

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.