CVE-2026-41206— PySpector has a Plugin Code Execution Bypass via Incomplete Static Analysis in PluginSecurity.validate_plugin_code
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-41206
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
PySpector has a Plugin Code Execution Bypass via Incomplete Static Analysis in PluginSecurity.validate_plugin_code
Source: NVD (National Vulnerability Database)
Vulnerability Description
PySpector is a static analysis security testing (SAST) Framework engineered for modern Python development workflows. The plugin security validator in PySpector uses AST-based static analysis to prevent dangerous code from being loaded as plugins. Prior to version 0.1.8, the blocklist implemented in `PluginSecurity.validate_plugin_code` is incomplete and can be bypassed using several Python constructs that are not checked. An attacker who can supply a plugin file can achieve arbitrary code execution within the PySpector process when that plugin is installed and executed. Version 0.1.8 fixes the issue.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
不完整的黑名单
Source: NVD (National Vulnerability Database)
Vulnerability Title
PySpector 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
PySpector是Tommaso Bona个人开发者的一个基于图的高性能Python静态安全分析框架。 PySpector 0.1.8之前版本存在安全漏洞，该漏洞源于插件安全验证器的黑名单不完整，可能导致任意代码执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| ParzivalHack | PySpector | < 0.1.8 | - |
II. Public POCs for CVE-2026-41206
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-41206
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same weakness: CWE-184
- CVE-2026-44115
OpenClaw < 2026.4.22 - Shell Expansion Bypass in Unquoted He - CVE-2026-44114
OpenClaw < 2026.4.20 - Environment Variable Namespace Collis - CVE-2026-43584
OpenClaw < 2026.4.10 - Insufficient Environment Variable Den - CVE-2026-43578
OpenClaw 2026.3.31 < 2026.4.10 - Privilege Escalation via Mi - CVE-2026-41934
Vvveb < 1.0.8.2 Authenticated RCE via Code Editor
V. Comments for CVE-2026-41206
No comments yet