Description

There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged to upgrade to Spark 3.5.8 or later. This CVE is marked as "low" since the path to exploit requires both relatively high permissions (ability to launch a Spark job) and requires tricking a user with higher permissions to log in and visit the Spark history web page. Users are encouraged to upgrade their Spark history servers to Spark 3.5.8 or later.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-09-02T11:17:20.173Z",
  "pubdate": "2026-09-02T11:17:20.173Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists within the Spark History Server, affecting versions prior to 3.5.8.\nThe vulnerability stems from inadequate sanitization of user-supplied data within Spark jobs, which, when rendered by the web interface, permits the injection and execution of arbitrary client-side code.\nImpact includes the potential for localized privilege escalation within the context of the user's browser session, potentially allowing an attacker to perform unauthorized actions on behalf of the victim.\nExploitation is categorized as 'low' risk because it necessitates a multi-stage process: the attacker must possess sufficient permissions to submit a malicious Spark job, and a user with higher administrative privileges must subsequently access the affected Spark history web page.\nThe primary remediation is to upgrade to Spark 3.5.8 or later, where input sanitization protocols have been updated to prevent the injection of malicious frontend scripts.",
  "technicalDetails": "The vulnerability is a classic stored Cross-Site Scripting (XSS) flaw located in the Spark History Server frontend rendering layer. The root cause is the lack of proper output escaping for data originating from submitted Spark jobs that is later displayed in the history UI.\nWhen a user executes a Spark job, the job metadata and logs are stored and eventually retrieved by the Spark History Server. If an attacker submits a job containing specially crafted strings—typically designed as payloads within job names, task descriptions, or other metadata fields—these strings are treated as executable code by the browser when the History Server renders them.\nThe attack flow follows a specific progression: 1) The attacker gains initial access to the Spark environment, granting the ability to initiate job submissions. 2) The attacker crafts a malicious Spark job payload containing unsanitized JavaScript designed for browser execution. 3) The malicious payload is persisted in the Spark History Server's backend data store upon job completion or execution progress reporting. 4) The attacker lures or waits for an authenticated user with elevated privileges (such as a cluster administrator) to navigate to the specific Spark History Server dashboard page associated with the malicious job. 5) The browser interprets the unescaped data as legitimate HTML/JavaScript, resulting in the execution of the attacker's script within the victim's authenticated session context.\nThe technical impact is limited to the client side; however, by compromising the browser session of an privileged user, an attacker can theoretically interact with the web interface to perform actions that the privileged user is authorized to perform, effectively resulting in privilege escalation from the perspective of the application's UI logic.\nBecause the payload is stored within the job history, it remains resident and potentially triggers every time the malicious entry is viewed. This persistent nature increases the likelihood of successful execution against administrative users monitoring cluster performance. The vulnerability persists across all Spark versions prior to 3.5.8 due to the historical absence of robust output encoding filters on the dynamic content injection points within the History Server dashboard templates."
}