Memray is a Python memory profiler that generates HTML reports. In versions prior to 1.19.2, the profiler inserts the command line of the profiled process directly into the report without escaping. This omission allows an attacker who can influence the command line to embed arbitrary JavaScript that is executed when a victim opens the report in a web browser. The vulnerability is a classic stored cross‑site scripting flaw (CWE‑79) and could lead to theft of session data, credential compromise, or arbitrary client‑side script execution.

The affected product is Bloomberg’s memray, available for all platforms that support Python. All releases older than v1.19.2 are vulnerable. No further version granularity is listed in the vendor data, but the advisory explicitly states that v1.19.2 contains the fix and earlier releases do not.

The CVSS score is 3.6, indicating low severity, and the EPSS score is below 1%, suggesting a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to control the command line of a process that memray profiles and then have a user open the resulting HTML report, pointing to a local or potentially network‑shared file. Because the attack vector is client‑side and not a network‑based remote service, the risk is limited but still worth addressing to prevent accidental or intentional client‑side compromise.