Crítica

Cross-site Scripting in Apache superset

Publicada: 23.01.2024
Actualizado: 11.10.2026 12:20

A stored cross-site scripting (XSS) vulnerability exists in Apache Superset before 3.0.3. An authenticated attacker with create/update permissions on charts or dashboards could store a script or add a specific HTML snippet that would act as a stored XSS.

For 2.X versions, users should change their config to include:

TALISMAN_CONFIG = { "content_security_policy": { "base-uri" : ["'self'"], "default-src": ["'self'"], "img-src": ["'self'", "blob:", "data:"], "worker-src": ["'self'", "blob:"], "connect-src": [ "'self'", " https://api.mapbox.com" https://api.mapbox.com" ;, " https://events.mapbox.com" https://events.mapbox.com" ;, ], "object-src": "'none'", "style-src": [ "'self'", "'unsafe-inline'", ], "script-src": ["'self'", "'strict-dynamic'"], }, "content_security_policy_nonce_in": ["script-src"], "force_https": False, "session_cookie_secure" : False, }

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

Plataforma	Paquete	Versiones vulnerables	Corregida en
Python (PyPI)	apache-superset	< 3.0.3	3.0.3

Referencias

Puntuación CVSS 9.6/10

Vector CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Debilidad (CWE): CWE-79
Plataforma: Python (PyPI)
Paquete: apache-superset
Publicada: 23.01.2024
Actualizado: 11.10.2026 12:20

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-rwhh-6x83-84v6 - CC BY 4.0

OSV / GitHub Advisory Database - PYSEC-2026-280 - PyPA Advisory Database; CC BY 4.0

Historial de vulnerabilidades: apache-superset

Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (66) en el archivo

Entradas en total: 66
Primera → última: 12.2019 02.2026
Sin corrección: 1
Explotada en ataques: 1

Distribución por gravedad

Crítica 3
Alta 14
Media 48
Baja 1

Divulgaciones por año

2019: 2
2020: 3
2021: 6
2022: 3
2023: 28
2024: 13
2025: 6
2026: 5

24.02.2026

Apache Superset Improper Authorization allows low-privileged users to bypass access controls

Alta CVE-2026-23982 < 6.0.0 6.0.0
24.02.2026

Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections

Alta CVE-2026-23984 < 6.0.0 6.0.0
30.05.2025

Apache Superset: Improper authorization bypass on row level security via SQL Injection

Alta CVE-2025-48912 < 4.1.2 4.1.2
13.05.2025

Apache Superset Allows Ownership Takeover

Alta · 8.8 CVE-2025-27696 < 4.1.2 4.1.2
09.12.2024

Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions

Crítica · 9.8 CVE-2024-53947 < 4.1.0 4.1.0
23.01.2024

Cross-site Scripting in Apache superset esta entrada

Crítica · 9.6 CVE-2023-49657 < 3.0.3 3.0.3
19.12.2023

Apache Superset incorrect write permissions vulnerability

Alta · 7.7 CVE-2023-49734 < 2.1.3, >= 3.0.0, < 3.0.2 2.1.3, 3.0.2
28.11.2023

Apache Superset - Elevation of Privilege

Alta · 7.3 CVE-2023-40610 < 2.1.2 2.1.2
24.04.2023

Apache superset missing check for default SECRET_KEY

Alta · 8.9 Explotada en ataques CVE-2023-27524 < 2.1.0 2.1.0
16.01.2023

Apache Superset vulnerable to Cross-Site Request Forgery via legacy REST API endpoints

Alta · 8.8 CVE-2022-43719 < 1.5.3, >= 2.0.0, < 2.0.1 1.5.3, 2.0.1
13.04.2022

Apache Superset before 1.4.2 is vulnerable to SQL injection in chart data requests. Users should update to 1.4.2 or higher which addresses this issue.

Crítica · 9.8 CVE-2022-27479 < 1.4.2 1.4.2
01.02.2022

Apache Superset up to and including 1.3.2 allowed for registered database connections password leak for authenticated users. This information could be accessed in a non-trivial way. Users should upgra

Alta · 6.5 CVE-2021-44451 < 1.4.0 1.4.0
17.11.2021

Improper output neutralization for Logs. A specific Apache Superset HTTP endpoint allowed for an authenticated user to forge log entries or inject malicious content into logs.

Alta · 6.5 CVE-2021-42250 < 1.3.2 1.3.2
12.11.2021

Apache Superset up to and including 1.3.1 allowed for database connections password leak for authenticated users. This information could be accessed in a non-trivial way.

Alta · 6.5 CVE-2021-41972 < 1.3.2 1.3.2
18.10.2021

Apache Superset up to and including 1.3.0 when configured with ENABLE_TEMPLATE_PROCESSING on (disabled by default) allowed SQL injection when a malicious authenticated user sends an http request with

Alta · 8.8 CVE-2021-41971 < 1.3.1 1.3.1
30.09.2020

In the course of work on the open source project it was discovered that authenticated users running queries against Hive and Presto database engines could access information via a number of templated

Alta · 8.1 CVE-2020-13952 < 0.37.2 0.37.2
17.09.2020

While investigating a bug report on Apache Superset, it was determined that an authenticated user could craft requests via a number of templated text fields in the product that would allow arbitrary a

Alta · 8.8 CVE-2020-13948 < 0.37.1 0.37.1

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación