{"id":"CVE-2026-41206","summary":"PySpector has a Plugin Code Execution Bypass via Incomplete Static Analysis in PluginSecurity.validate_plugin_code","details":"PySpector is a static analysis security testing (SAST) Framework engineered for modern Python development workflows. The plugin security validator in PySpector uses AST-based static analysis to prevent dangerous code from being loaded as plugins. Prior to version 0.1.8, the blocklist implemented in `PluginSecurity.validate_plugin_code` is incomplete and can be bypassed using several Python constructs that are not checked. An attacker who can supply a plugin file can achieve arbitrary code execution within the PySpector process when that plugin is installed and executed. Version 0.1.8 fixes the issue.","aliases":["GHSA-vp22-38m5-r39r","PYSEC-2026-3031"],"modified":"2026-07-15T01:49:15.964141839Z","published":"2026-04-23T00:42:49.204Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41206.json","unresolved_ranges":[{"source":"AFFECTED_FIELD","extracted_events":[{"fixed":"0.1.8"}]}],"cna_assigner":"GitHub_M","cwe_ids":["CWE-184"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41206.json"},{"type":"ADVISORY","url":"https://github.com/ParzivalHack/PySpector/security/advisories/GHSA-vp22-38m5-r39r"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41206"},{"type":"FIX","url":"https://github.com/ParzivalHack/PySpector/commit/3c9547157fc07396f22b26b3484a9a91eba98555"},{"type":"FIX","url":"https://github.com/ParzivalHack/PySpector/commit/4e279e078c53d760fd321ff9b698d683c65ccb8e"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/parzivalhack/pyspector","events":[{"introduced":"0"},{"fixed":"3c9547157fc07396f22b26b3484a9a91eba98555"},{"fixed":"4e279e078c53d760fd321ff9b698d683c65ccb8e"}],"database_specific":{"source":"REFERENCES"}}],"versions":["v0.1.6-beta","v0.1.5-beta","v0.1.4-beta-hotfix","v0.1.4-beta","v0.1.3-beta","v0.1.2-beta","v0.1.1-beta"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41206.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N"}]}