Approved changes feed: RSS · Atom
cpe:2.3:a:bloomberg:memray:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Bloomberg (e177c2b9-cfba-53fd-ba48-4ac7ba7f8741) |
|---|---|
| Product | Memray (48929169-05e9-5f09-96bc-3da953f2f19f) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/bloomberg/memray |
purl2cpe | 2026-06-01 10:16:24.633704 |
pkg:pypi/memray |
purl2cpe | 2026-06-01 10:16:24.633707 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-32722 |
vulnerable | 2026-06-08 07:57:18.080301 |
Memray-generated HTML reports vulnerable to Stored XSS via unescaped command-line metadata
LOW (3.6)
Memray is a memory profiler for Python. Prior to Memray 1.19.2, Memray rendered the command line of the tracked process directly into generated HTML reports without escaping. Because there was no escaping, attacker-controlled command line arguments were inserted as raw HTML into the generated report. This allowed JavaScript execution when a victim opened the generated report in a browser. Version 1.19.2 fixes the issue.
Published: 2026-03-18T21:25:21.495Z
Updated: 2026-03-19T17:39:50.970Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.