CVE-2026-32722: Bloomberg Memray XSS Vulnerability

CVE-2026-32722 Overview

CVE-2026-32722 is a Cross-Site Scripting (XSS) vulnerability in Bloomberg Memray, a memory profiler for Python. Prior to version 1.19.2, Memray rendered the command line of the tracked process directly into generated HTML reports without proper escaping. Because there was no escaping, attacker-controlled command line arguments were inserted as raw HTML into the generated report. This allowed JavaScript execution when a victim opened the generated report in a browser.

Critical Impact
Attackers can inject malicious JavaScript code through command line arguments that execute when victims view Memray-generated HTML reports, potentially leading to credential theft, session hijacking, or further malicious actions.

Affected Products

Bloomberg Memray versions prior to 1.19.2
Python-based Memray memory profiler installations
Applications using Memray HTML report generation functionality

Discovery Timeline

2026-03-18 - CVE CVE-2026-32722 published to NVD
2026-03-19 - Last updated in NVD database

Technical Details for CVE-2026-32722

Vulnerability Analysis

This vulnerability (CWE-79) is a stored Cross-Site Scripting (XSS) flaw that occurs due to improper output encoding in Memray's HTML report generation. When Memray generates HTML reports for memory profiling sessions, it includes metadata about the tracked process, including the command line used to invoke the profiled application. The vulnerable code directly interpolated the metadata.command_line variable into the HTML template without applying proper HTML entity escaping.

The vulnerability requires user interaction—specifically, a victim must open a maliciously crafted HTML report in their browser. The attack can be delivered by an attacker who has the ability to influence the command line arguments of a profiled process, then distributing the generated report to unsuspecting users.

Root Cause

The root cause lies in the Jinja2 template rendering within Memray's src/memray/reporters/templates/base.html file. The template used {{ metadata.command_line }} without the escape filter (|e), allowing raw HTML and JavaScript to be rendered in the browser. Jinja2 templates require explicit escaping or auto-escaping to be enabled to prevent XSS vulnerabilities when rendering user-controllable content.

Attack Vector

An attacker can exploit this vulnerability by injecting malicious JavaScript into command line arguments when running a process under Memray's profiler. For example, an attacker could craft command line arguments containing <script> tags or other HTML event handlers. When the victim opens the generated HTML report, the injected JavaScript executes in the context of the victim's browser session.

The attack requires network access to distribute the malicious report and user interaction to open it. The scope is changed as the vulnerability in Memray affects the security context of the victim's browser where the report is viewed.

text

           </button>
         </div>
         <div class="modal-body">
-          Command line: <code>{{ metadata.command_line }}</code><br>
+          Command line: <code>{{ metadata.command_line|e }}</code><br>
           Start time: <span id="stats-start-time"> {{ metadata.start_time }}</span><br>
           End time: <span id="stats-end-time"> {{ metadata.end_time }}</span><br>
           Duration: {{ metadata.end_time - metadata.start_time }}<br>

Source: GitHub Commit ba6e4e2e9930f9641bed7adfdf43c8e2545ce249

Detection Methods for CVE-2026-32722

Indicators of Compromise

Memray HTML reports containing suspicious <script> tags or JavaScript event handlers within the command line display section
Command line arguments in profiled processes containing HTML entities or JavaScript code patterns
User reports of unexpected browser behavior when viewing Memray-generated reports
Browser security warnings or Content Security Policy violations when opening Memray reports

Detection Strategies

Review existing Memray HTML reports for embedded JavaScript or suspicious HTML markup in the command line section
Implement file integrity monitoring on systems that generate Memray reports to detect tampering
Use browser-based security tools to scan HTML reports before opening them in production environments
Monitor for Memray installations running versions prior to 1.19.2

Monitoring Recommendations

Audit all Memray installations in your environment and verify version numbers against the patched release 1.19.2
Implement Content Security Policy (CSP) headers when serving Memray reports via web servers
Configure browser security settings to restrict JavaScript execution in locally opened HTML files
Review system logs for unusual command line patterns that may indicate exploitation attempts

How to Mitigate CVE-2026-32722

Immediate Actions Required

Upgrade Bloomberg Memray to version 1.19.2 or later immediately
Regenerate any existing HTML reports using the patched version of Memray
Review and delete any HTML reports generated from untrusted sources or processes
Warn users not to open Memray HTML reports from unknown or untrusted origins

Patch Information

Bloomberg has released version 1.19.2 which fixes this vulnerability by adding proper HTML escaping to the command line output in generated reports. The fix applies the Jinja2 escape filter (|e) to the metadata.command_line variable, ensuring that any HTML special characters are properly encoded before being rendered in the browser.

For patch details, see the GitHub Security Advisory GHSA-r5pr-887v-m2w9 and the GitHub Release v1.19.2.

Workarounds

If immediate upgrade is not possible, avoid opening Memray HTML reports in web browsers—use alternative analysis methods
Implement Content Security Policy headers that block inline script execution when serving reports via web server
Manually review and sanitize any HTML reports before distribution or viewing
Use isolated browser environments or sandboxed viewers for examining untrusted Memray reports

bash

# Upgrade Memray to patched version
pip install --upgrade memray>=1.19.2

# Verify installed version
pip show memray | grep Version