Code Execution Vulnerability in PySpector Static Analysis Tool
CVE-2026-41206

6.9MEDIUM

Key Information:

Vendor

Parzivalhack

Status
Pyspector
Vendor
CVE Published:
23 April 2026

What is CVE-2026-41206?

PySpector, a static analysis security testing framework for Python, has a vulnerability in its plugin security validation mechanism prior to version 0.1.8. This issue allows attackers to bypass an incomplete blocklist in the 'validate_plugin_code' function, potentially leading to arbitrary code execution when malicious plugins are installed and executed. Version 0.1.8 addresses this security hole to enhance overall safety.

Affected Version(s)

PySpector < 0.1.8

References

https://github.com/ParzivalHack/PySpector/security/adviso...
x_refsource_CONFIRM
https://github.com/ParzivalHack/PySpector/commit/3c954715...
x_refsource_MISC
https://github.com/ParzivalHack/PySpector/commit/4e279e07...
x_refsource_MISC

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.