Threats affecting pkg:pypi/memray

CVE-2026-32722 is a cross-site scripting (XSS) vulnerability in Bloomberg's Memray, a Python memory profiler. Versions prior to 1.19.2 render command line arguments directly into HTML reports without proper escaping, allowing attacker-controlled input to execute JavaScript when the report is viewed in a browser. The vulnerability requires local access to generate a report with malicious input and user interaction to open the report. The CVSS score is 3.6 (low severity) due to limited impact and exploitation complexity. No known exploits are currently reported in the wild. The issue is fixed in Memray version 1.19.