PySpector is a static analysis security testing (SAST) Framework engineered for modern Python development workflows. The plugin security validator in PySpector uses AST-based static analysis to prevent dangerous code from being loaded as plugins. Prior to version 0.1.8, the blocklist implemented in `PluginSecurity.validate_plugin_code` is incomplete and can be bypassed using several Python constructs that are not checked. An attacker who can supply a plugin file can achieve arbitrary code execution within the PySpector process when that plugin is installed and executed. Version 0.1.8 fixes the issue.
Fix
Patch, vendor advisory and mitigation references on NVD 4
- https://github.com/ParzivalHack/PySpector/commit/3c9547157fc07396f22b26b3484a9a91eba98555 Patch
- https://github.com/ParzivalHack/PySpector/commit/4e279e078c53d760fd321ff9b698d683c65ccb8e Patch
- https://github.com/ParzivalHack/PySpector/security/advisories/GHSA-vp22-38m5-r39r Exploit, Vendor Advisory
- https://github.com/ParzivalHack/PySpector/security/advisories/GHSA-vp22-38m5-r39r Exploit, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 6.9 · parzivalhackNVD modified 2026-10-26 21:10
Affected (CPE criteria) 1
cpe:2.3:a:parzivalhack:pyspector:*:*:*:*:*:python:*:*
References 4
- https://github.com/ParzivalHack/PySpector/commit/3c9547157fc07396f22b26b3484a9a91eba98555 Patch
- https://github.com/ParzivalHack/PySpector/commit/4e279e078c53d760fd321ff9b698d683c65ccb8e Patch
- https://github.com/ParzivalHack/PySpector/security/advisories/GHSA-vp22-38m5-r39r Exploit, Vendor Advisory
- https://github.com/ParzivalHack/PySpector/security/advisories/GHSA-vp22-38m5-r39r Exploit, Vendor Advisory