CVE-2026-33139: 
Python vulnerability analysis and mitigation

CVE-2026-33139 is a plugin sandbox bypass vulnerability in PySpector (a Python code inspection tool) that allows arbitrary code execution on a user's local machine via a malicious plugin file. It affects PySpector versions <= 0.1.6 (pip package by ParzivalHack) and was patched in version 0.1.7. The vulnerability was published by the maintainer on March 17, 2026, and added to the GitHub Advisory Database on March 18, 2026. It carries a CVSS v3.1 score of 7.8 (High) and a CVSS v4.0 score of 8.3 (High) (GitHub Advisory, PySpector Advisory).

The root cause is classified as CWE-184 (Incomplete List of Disallowed Inputs). The validate_plugin_code() function in plugin_system.py performs static AST (Abstract Syntax Tree) analysis to block dangerous API calls, but its internal resolve_name() helper only handles ast.Name and ast.Attribute node types, returning None for all others. When a malicious plugin uses indirect function calls via getattr() — for example, getattr(os, 'system') — the outer call's func node is of type ast.Call, causing resolve_name() to return None and the security check to be silently skipped. The plugin then incorrectly passes the trust workflow and executes arbitrary system commands when loaded. Exploitation requires the victim to run pyspector plugin install --trust on the malicious file, making this a social-engineering-dependent, local attack vector (GitHub Advisory, PySpector Advisory).

Successful exploitation grants an attacker full read/write access to the victim's local filesystem, the ability to exfiltrate sensitive data including environment variables, API keys, and credentials, and the ability to establish persistence mechanisms. In CI/CD environments where PySpector runs with elevated permissions (e.g., as pre-commit hooks or scheduled scans), exploitation can enable lateral movement across pipelines and infrastructure. Any PySpector user who installs third-party plugins from outside the official repository is potentially at risk (GitHub Advisory).

A proof-of-concept (PoC) exploit with a concrete 4-step reproduction sequence is publicly available in the official security advisory (PySpector Advisory). There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.025% (0.000250), placing it in a low exploitation-probability tier. The attack requires active user interaction (explicitly running pyspector plugin install --trust), which meaningfully limits opportunistic exploitation. The vulnerability was reported by researcher Shinigami81 (GitHub Advisory).

1. Craft a malicious plugin: Create a Python plugin file (e.g., /tmp/evil_plugin.py) that uses getattr-based indirect calls to bypass AST validation — for example, getattr(os, 'system')('malicious_command') — instead of direct calls like os.system() that the validator would detect.
2. Verify bypass: Optionally run the PySpector Plugin Validator module against the malicious file to confirm it incorrectly marks the plugin as safe, validating the bypass works on the target version (<= 0.1.6).
3. Social engineer the victim: Deliver the malicious plugin file to a PySpector user and convince them to install it using the trust flag: pyspector plugin install /tmp/evil_plugin.py --trust.
4. Trigger execution: Instruct or wait for the victim to execute a scan that loads the plugin: pyspector scan /any/target --plugin evil. The malicious code executes with the permissions of the PySpector process, achieving arbitrary code execution on the local machine (PySpector Advisory).

• File System: Presence of unexpected or unrecognized .py plugin files in the PySpector plugin directory; plugin files containing getattr(os, ...) or similar indirect call patterns rather than direct API calls.
• Logs: PySpector logs showing plugin installation with the --trust flag for plugins not sourced from the official repository; scan executions referencing unknown or externally sourced plugin names.
• Process: Unexpected child processes spawned by the PySpector process (e.g., shell commands, curl, wget, python subprocesses); unusual access to environment variable stores or credential files by the PySpector process.
• Network: Outbound connections from the PySpector process or its child processes to unknown external IP addresses, potentially indicating data exfiltration of credentials or API keys (PySpector Advisory).

Upgrade PySpector to version 0.1.7 or later, which patches the validate_plugin_code() / resolve_name() logic to correctly handle ast.Call node types. As a workaround, only install plugins from the official PySpector repository and never use the --trust flag with third-party or untrusted plugin files. In CI/CD environments, restrict PySpector's runtime permissions, run it in isolated/sandboxed environments, and audit all installed plugins. Review plugin source code manually before installation (GitHub Advisory, PySpector Advisory).

The vulnerability was discovered and reported by researcher Shinigami81, and a write-up titled "CVE-2026-33139: How I Found My First CVE — Bypassing PySpector's Plugin Security Sandbox" was published on Medium, providing additional technical context on the discovery process (Medium Write-up). The CVE was noted by automated CVE tracking accounts on social platforms including Bluesky. No major vendor statements or widespread media coverage beyond the advisory and researcher blog post have been observed.