org.apache.spark:spark-core_2.12

4 results · Feed

• Medium 6.1
  CVE-2026-32773

  Apache Spark: XSS Vulnerability in Spark Web 3.5.4

  There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged to upgrade to Spark…

  Apache Software Foundation Apache Spark pyspark org.apache.spark:spark-core_2.12 Maven PyPI
  Sep 2, 2026
• High 8.8
  CVE-2025-54920

  Apache Spark: Spark History Server Code Execution Vulnerability

  This issue affects Apache Spark: before 3.5.7 and 4.0.1. Users are recommended to upgrade to version 3.5.7 or 4.0.1 and above, which fixes the issue. Summary Apache Spark 3.5.4 and earlier versions contain a code execution vulnerability in the Spark History W…

  Apache Software Foundation Apache Spark org.apache.spark:spark-core_2.11 org.apache.spark:spark-core_2.10 Maven
  Mar 14, 2026
• Medium 6.4
  CVE-2023-22946

  Apache Spark proxy-user privilege escalation from malicious configuration class

  In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges. The application can execute code with the privileges of the submitting user, however, by providing malicious configuration-rela…

  Apache Software Foundation Apache Spark pyspark org.apache.spark:spark-core_2.13 Maven PyPI
  Apr 17, 2023
• Medium 5.4
  CVE-2022-31777

  Apache Spark XSS vulnerability in log viewer UI Javascript

  A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the logs which would be returned in log…

  Apache Software Foundation Apache Spark pyspark org.apache.spark:spark-core_2.11 Maven PyPI
  Nov 1, 2022