CVE-2026-32722: Bloomberg Memray

Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days.

Memray is a memory profiler for Python. Prior to Memray 1.19.2, Memray rendered the command line of the tracked process directly into generated HTML reports without escaping. Because there was no escaping, attacker-controlled command line arguments were inserted as raw HTML into the generated report. This allowed JavaScript execution when a victim opened the generated report in a browser. Version 1.19.2 fixes the issue.

Affected products

• Bloomberg Memray: before 1.19.2 (fixed in 1.19.2)

Published 2026-03-18. Last modified 2026-06-17.