CVE-2026-33139 PySpector: Plugin Sandbox Bypass leads to Arbitrary Code Execution
Attackers can bypass plugin security checks in PySpector to execute arbitrary code on the developer's machine via indirect function calls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-33139?
CVE-2026-33139 is a high-severity code injection vulnerability in ParzivalHack PySpector, published on 20 Mar 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
PySpector is a static analysis security testing (SAST) Framework engineered for modern Python development workflows. PySpector versions 0.1.6 and prior are affected by a security validation bypass in the plugin system. The validate_plugin_code() function in plugin_system.py, performs static AST analysis to block dangerous API calls before a plugin is trusted and executed. However, the internal resolve_name() helper only handles ast.Name and ast.Attribute node types, returning None for all others. When a plugin uses indirect function calls via getattr() (such as getattr(os, 'system')) the outer call's func node is of type ast.Call, causing resolve_name() to return None, and the security check to be silently skipped. The plugin incorrectly passes the trust workflow, and executes arbitrary system commands on the user's machine when loaded. This issue has been patched in version 0.1.7.
Weakness: CWE-184
Which versions are affected by CVE-2026-33139?
3 open source packages ship an affected version, including pyspector. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pyspector PyPI | All versions | 0.1.7 |
pyspector PyPI | All versions | 0.1.7 |
pyspector PyPI | All versions | 0.1.7 |
Products include Parzivalhack Pyspector.
How do I fix CVE-2026-33139?
Upgrade pyspector to 0.1.7 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-33139 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33139 exists.
Other vulnerabilities in ParzivalHack PySpector
Sources
Also known as GHSA-v3xv-8vc3-h2m6, PYSEC-2026-3030.