A stored cross‑site scripting flaw exists in PySpector’s HTML report generation. When a Python file containing JavaScript code inside a string passed to eval() is scanned, the discovered snippet is inserted into the generated HTML report without sanitization. Viewing that report in a browser causes the embedded JavaScript to execute in the browser’s local file context, allowing an attacker to run arbitrary scripts on the victim’s machine.

The vulnerability affects all ParzivalHack PySpector releases up to and including version 0.1.6. Version 0.1.7 and later contain the fix.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score of less than 1% shows a low likelihood of active exploitation, and the issue is not listed in the CISA KEV catalog. Exploitation would require an attacker to craft a Python source file with malicious JavaScript, have PySpector generate an HTML report incorporating that file, and then have a user open the resulting report in a browser. The attack is local to the environment that views the report. Prevention hinges on applying the vendor patch and treating generated reports as potentially unsafe content.