{"action":"Upgrade org.apache.spark:spark-core_2.12 to 3.5.7 or later.","affected":[{"fixed":"3.5.7","introduced":"0"}],"component":"org.apache.spark:spark-core_2.12","cve_ids":["CVE-2025-54920"],"ecosystem":"Maven","epss":0.05422,"exploited":false,"fixed_versions":["3.5.7"],"ghsa_id":"GHSA-jwp6-cvj8-fw65","id":"tcs_01M5N93TSKP82FN430KZK5S4RE","modified_at":"2026-09-10T03:51:00.600107520Z","published_at":"2026-03-16T15:30:41Z","references":["https://osv.dev/vulnerability/GHSA-jwp6-cvj8-fw65","https://nvd.nist.gov/vuln/detail/CVE-2025-54920","https://github.com/apache/spark/pull/51312","https://github.com/apache/spark/pull/51323","https://github.com/apache/spark","https://issues.apache.org/jira/browse/SPARK-52381","https://lists.apache.org/thread/4y9n0nfj7m68o2hpmoxgc0y7dm1lo02s","http://www.openwall.com/lists/oss-security/2026/03/13/4"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-jwp6-cvj8-fw65#Maven/org.apache.spark:spark-core_2.12","url":"https://osv.dev/vulnerability/GHSA-jwp6-cvj8-fw65"}],"summary":"Apache Spark: Spark History Server Code Execution Vulnerability"}