CVE-2026-32773: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in Apache Software Foundation Apache Spark

This vulnerability involves improper neutralization of script-related HTML tags (CWE-80) in the Apache Spark History Server prior to version 3.5.8. A malicious Spark job can generate arbitrary unescaped frontend code, which may lead to a minimal privilege escalation in the browser of a user who views the Spark History Server page. The attack vector requires network access and user interaction with a privileged account. The CVSS 3.1 score is 6.1, reflecting network attack vector, low attack complexity, no privileges required for the attacker, but user interaction is needed, and the scope is changed with low confidentiality and integrity impact but no availability impact. No known exploits in the wild have been reported. The recommended remediation is to upgrade to version 3.5.8 or later.

Successful exploitation can lead to minimal privilege escalation in the browser of a user with higher privileges who visits the Spark History Server page. This could allow an attacker to execute arbitrary script code in the context of the victim's browser session, potentially compromising confidentiality and integrity of data accessible via the browser. However, exploitation requires the attacker to have the ability to launch a Spark job and to trick a privileged user into visiting the malicious page, limiting the practical impact.

Users should upgrade their Apache Spark History Server to version 3.5.8 or later, where this vulnerability is fixed. No other official remediation or temporary fixes are indicated. Patch status is not explicitly stated but the recommendation to upgrade to 3.5.8 or later implies an official fix is available in that version.