Vulnerability in Parzivalhack Pyspector
CVE-2026-33139
PySpector is a static analysis security testing (SAST) Framework engineered for modern Python development workflows. PySpector versions 0.1.6 and prior are affected by a security validation bypass in the plugin system. The validate_plugin_code() function in plugin_system.py, performs static AST analysis to block dangerous API calls before a plugin is trusted and executed. However, the internal resolve_name() helper only handles ast.Name and ast.Attribute node types, returning None for all others. When a plugin uses indirect function calls via getattr() (such as getattr(os, 'system')) the outer call's func node is of type ast.Call, causing resolve_name() to return None, and the security check to be silently skipped. The plugin incorrectly passes the trust workflow, and executes arbitrary system commands on the user's machine when loaded. This issue has been patched in version 0.1.7.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.002 (6.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 7th percentile — 6.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: +0.000
Affected products
- Parzivalhack Pyspector — versions < 0.1.7
Weakness classification (CWE)
References
- github.com/ParzivalHack/PySpector/security/advisories/GHSA-v3xv-8vc3-h2m6 (Exploit, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-33139?
- CVE-2026-33139 is a high-severity vulnerability in Parzivalhack Pyspector, classified under Incomplete List of Disallowed Inputs. CVSS score: 7.8/10. Published 2026-03-20.
- How severe is CVE-2026-33139?
- High severity. CVSS v3 base score is 7.8 out of 10.