CVE-2026-33139

The record

PySpector is a static analysis security testing (SAST) Framework engineered for modern Python development workflows. PySpector versions 0.1.6 and prior are affected by a security validation bypass in the plugin system. The validate_plugin_code() function in plugin_system.py, performs static AST analysis to block dangerous API calls before a plugin is trusted and executed. However, the internal resolve_name() helper only handles ast.Name and ast.Attribute node types, returning None for all others. When a plugin uses indirect function calls via getattr() (such as getattr(os, 'system')) the outer call's func node is of type ast.Call, causing resolve_name() to return None, and the security check to be silently skipped. The plugin incorrectly passes the trust workflow, and executes arbitrary system commands on the user's machine when loaded. This issue has been patched in version 0.1.7.

Affected packages

Related vulnerabilities

• CVE-2026-114729 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content… CWE-184
• CVE-2026-114728 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content… CWE-184
• CVE-2026-106445 Handlebars provides the power necessary to let users build semantic templates. CWE-184
• CVE-2026-102828 simple-git, an interface for running git commands in any node.js application, enables… CWE-184
• CVE-2026-102829 simple-git, an interface for running git commands in any node.js application, enables… CWE-184
• CVE-2026-87985 An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass… CWE-184
• CVE-2026-87911 An OS command injection weakness in the read-only enforcement of the SQL validation… CWE-184
• CVE-2026-85788 Incomplete list of disallowed inputs in the mutable SQL detector component in Amazon… CWE-184