MEDIUM 5.4

PYSEC-2026-777

Apache Superset is vulnerable to Cross-Site Scripting (XSS)

Details

Upload data forms do not correctly render user input leading to possible XSS attack vectors that can be performed by authenticated users with database connection update permissions. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI / apache-superset

Introduced in: 0 Fixed in: 1.5.3

Fix pip install --upgrade 'apache-superset>=1.5.3'

References

https://nvd.nist.gov/vuln/detail/CVE-2022-43718 [ADVISORY]
https://github.com/apache/superset [PACKAGE]
https://lists.apache.org/thread/8615608jt2x7b3rmqrtngldy8pn3nz2r [WEB]
https://pypi.org/project/apache-superset [PACKAGE]
https://github.com/advisories/GHSA-79x5-cv79-49rj [ADVISORY]