org.apache.spark:spark-core_2.13

3 results · Clear filters · Feed

• Medium 6.1
  CVE-2026-32773

  Apache Spark: XSS Vulnerability in Spark Web 3.5.4

  There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged to upgrade to Spark…

  Apache Software Foundation Apache Spark pyspark org.apache.spark:spark-core_2.12 Maven PyPI
  Sep 2, 2026
• Medium 6.4
  CVE-2023-22946

  Apache Spark proxy-user privilege escalation from malicious configuration class

  In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges. The application can execute code with the privileges of the submitting user, however, by providing malicious configuration-rela…

  Apache Software Foundation Apache Spark pyspark org.apache.spark:spark-core_2.13 Maven PyPI
  Apr 17, 2023
• Medium 5.4
  CVE-2022-31777

  Apache Spark XSS vulnerability in log viewer UI Javascript

  A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the logs which would be returned in log…

  Apache Software Foundation Apache Spark pyspark org.apache.spark:spark-core_2.11 Maven PyPI
  Nov 1, 2022