Skip to content
Log inStart free trial

GHSA-fpmr-qmgh-42x2 BIT-superset-2022-43720 CVE-2022-43720 PYSEC-2026-782

Apache Superset vulnerable to Injection

Medium PyPI
Severity
5.4 / 10
Medium · CVSS 3.1
Exploit chance (EPSS)
1.29%
Chance of exploitation in the next 30 days. Higher than 70.21% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Fix
2.0.1
Upgrade apache-superset to this version or later

Description

An authenticated attacker with write CSS template permissions can create a record with specific HTML tags that will not get properly escaped by the toast message displayed when a user deletes that specific CSS template record. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

Affected versions

PyPI

PackageVulnerableFixed in
apache-superset
<= 1.5.2
 No fix yet
apache-superset 1 listed versions No fix yet
apache-superset
< 1.5.3
>= 2.0.0, < 2.0.1
1.5.3
2.0.1

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

apache-superset PyPI → 2.0.1

pip
pip install --upgrade "apache-superset>=2.0.1"
poetry
poetry add "apache-superset>=2.0.1"
uv
uv add "apache-superset>=2.0.1"

Severity breakdown

CVSS 3.1 5.4

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

Weakness

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

How to prevent it
  • Requirements: Programming languages and supporting technologies might be chosen which are not subject to these issues.
  • Implementation: Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-5cx2-vq3h-x52c
Apache superset missing check for default SECRET_KEY
Critical Known exploited Also affects apache-superset
GHSA-mwf2-qr4v-94h2
Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
Medium Also affects apache-superset
GHSA-h294-8fxm-m2pj
Apache Superset allows authenticated users to view sensitive data without explicit permissions
Medium Also affects apache-superset
GHSA-3m2g-v7jf-7fxc
Apache Superset Improper Authorization allows low-privileged users to bypass access controls
Medium Also affects apache-superset
GHSA-gvxg-9hqx-f4rg
Apache Superset allows privileged users to conduct error-based SQL Injection
Medium Also affects apache-superset
GHSA-48m2-v2r8-h23m
Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine
Medium Also affects apache-superset
GHSA-mhpq-m962-mg92
Apache Superset allows authenticated users to discover metadata about datasources they don't have permission to access
Medium Also affects apache-superset
GHSA-fxgf-3xh6-m2pp
Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions
Medium Also affects apache-superset
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor