Apache Spark: XSS Vulnerability in Spark Web 3.5.4 (CVE-2026-32773)

CVE-2026-32773 is an XSS vulnerability (CWE-80) in the Apache Spark History Server before version 3.5.8. The vulnerability arises from a lack of proper escaping of script-related HTML tags, enabling a malicious Spark job to inject arbitrary unescaped code into the frontend. Exploitation requires the ability to launch a Spark job and social engineering to have a privileged user visit the affected page. This vulnerability is rated medium severity with a CVSS score of 6.1 and is fixed in Apache Spark 3.5.8.

Successful exploitation could allow an attacker to execute arbitrary script code in the context of a user's browser session with access to the Spark History Server. This could lead to minimal privilege escalation within the browser, potentially exposing sensitive information or performing actions on behalf of the user. However, exploitation requires both the ability to launch a Spark job and to trick a privileged user into visiting the malicious page, limiting the attack surface.

Users should upgrade their Apache Spark History Server to version 3.5.8 or later to remediate this vulnerability. No other mitigation steps are indicated by the vendor advisory.