GHSA-f8vc-f28w-x9c9

Apache Superset Cross-site Scripting (XSS) vulnerability on the Explore page

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-32609

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	apache-superset	< 1.2.0	1.2.0

Details

As written in the advisory (Markdown source, shown as plain text).

Apache Superset up to and including 1.1 does not sanitize titles correctly on the Explore page. This allows an attacker with Explore access to save a chart with a malicious title, injecting html (including scripts) into the page.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-32609 advisory
https://github.com/advisories/GHSA-f8vc-f28w-x9c9 advisory
https://github.com/apache/superset web
https://github.com/pypa/advisory-database/tree/main/vulns/apache-superset/PYSEC-2021-377.yaml web
https://lists.apache.org/thread.html/r2c09254e98b4f8b3deb422762bd0e2aa6d743b72d96c2f90cbaae31a%40%3Cdev.superset.apache.org%3E web