Vulnerabilities for pyspark

First version without a known vulnerability: 4.0.0.dev1

Details

• PYSEC-2026-39662026-09-02

  There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged to upgrade to Spark 3.5.8 or later.

  Fixed in: 3.5.8

• GHSA-6p6v-m64v-jx8q2025-10-15

  Apache Spark has Inadequate Encryption Strength

  Fixed in: 3.5.2, 3.4.4

• GHSA-59hw-j9g6-mfg32023-05-02

  Apache Spark UI vulnerable to Command Injection

  Fixed in: 3.2.2

• GHSA-329j-jfvr-rhr62023-04-17

  Apache Spark vulnerable to Improper Privilege Management

  Fixed in: 3.3.3, 3.3.2, 3.4.0

• GHSA-43xg-8wmj-cw8h2022-11-01

  Apache Spark vulnerable to Log Injection

  Fixed in: 3.2.2, 3.3.1

• GHSA-4x9r-j582-cgr82022-07-19

  Apache Spark UI can allow impersonation if ACLs enabled

  Fixed in: 3.2.2, 3.1.3

• GHSA-9rr6-jpg7-9jg62022-03-11

  Authentication Bypass by Capture-replay in Apache Spark

  Fixed in: 3.1.3

• GHSA-wgx7-jwwm-cgjv2022-02-10

  Improper Authentication in Apache Spark

  Fixed in: 2.4.6

• GHSA-fp5j-3fpf-mhj52019-08-08

  Sensitive data written to disk unencrypted in Spark

  Fixed in: 2.3.3

• GHSA-6mqq-8r44-vmjc2019-03-14

  Exposure of Sensitive Information to an Unauthorized Actor in Apache Spark

  Fixed in: 2.1.3, 2.2.2, 2.3.1

• GHSA-fvxv-9xxr-h7wj2019-02-07

  Pyspark User Impersonation Vulnerability

  Fixed in: 2.3.2, 2.2.3

• GHSA-8rhc-48pp-52gr2018-11-09

  Apache Spark Deserialization of Untrusted Data vulnerability

  Fixed in: 2.1.2