MEDIUM6.5

PYSEC-2026-1184

Apache Superset SQL injection vulnerability

Quick fix

PYSEC-2026-1184 — apache-superset: upgrade to the fixed version with the command below.

pip install --upgrade 'apache-superset>=2.1.3'

Details

A where_in JINJA macro allows users to specify a quote, which combined with a carefully crafted statement would allow for SQL injection in Apache Superset.This issue affects Apache Superset: before 2.1.3, from 3.0.0 before 3.0.2.

Users are recommended to upgrade to version 2.1.3 or 3.0.2, which fixes the issue.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/apache-superset

Introduced in: 0Fixed in: 2.1.3

Fixpip install --upgrade 'apache-superset>=2.1.3'

References

https://nvd.nist.gov/vuln/detail/CVE-2023-49736[ADVISORY]
https://github.com/apache/superset/pull/25779[WEB]
https://github.com/apache/superset/commit/1d403dab9822a8cee6108669c53e53fad881c751[WEB]
https://github.com/apache/superset/commit/34101594e284ab3acce692f41aff7759ccb4bf1d[WEB]
https://github.com/apache/superset[PACKAGE]
https://lists.apache.org/thread/1kf481bgs3451qcz6hfhobs7xvhp8n1p[WEB]
http://www.openwall.com/lists/oss-security/2023/12/19/2[WEB]
https://pypi.org/project/apache-superset[PACKAGE]
https://github.com/advisories/GHSA-jfxj-xf67-x723[ADVISORY]