All vulnerabilities
CVE-2023-49657BIT-superset-2023-49657GHSA-rwhh-6x83-84v6PYSEC-2026-280

apache-superset: Cross-site Scripting in Apache superset

Apache Software Foundation apache-supersetpipLibraries & packages
Open in ThreatlineRecord JSON
CVSS
9.6Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.84%Chance of exploitation activity in the next 30 days, higher than 57% of CVEs. Scored 27 Oct 2026FIRST EPSS
Fixed in3.0.3Fixed versionGitHub
Published23 Jan 2024Updated 27 Oct 2026CVE List

What fixes it

  • 3.0.3apache-superset, pipGitHub
  • 3.0.3Apache SupersetCVE List
  • 3.0.3apache-superset, PyPIOSVpip install "apache-superset>=3.0.3"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

A stored cross-site scripting (XSS) vulnerability exists in Apache Superset before 3.0.3. An authenticated attacker with create/update permissions on charts or dashboards could store a script or add a specific HTML snippet that would act as a stored XSS.

For 2.X versions, users should change their config to include:

TALISMAN_CONFIG = { "content_security_policy": { "base-uri": ["'self'"], "default-src": ["'self'"], "img-src": ["'self'", "blob:", "data:"], "worker-src": ["'self'", "blob:"], "connect-src": [ "'self'", " https://api.mapbox.com" https://api.mapbox.com" ;, " https://events.mapbox.com" https://events.mapbox.com" ;, ], "object-src": "'none'", "style-src": [ "'self'", "'unsafe-inline'", ], "script-src": ["'self'", "'strict-dynamic'"], }, "content_security_policy_nonce_in": ["script-src"], "force_https": False, "session_cookie_secure": False, }

Text from GitHub Advisory Database

Affected versions 43

  • apache-superset, pip< 3.0.3GitHub
  • Apache Supersetaffected: all versions before 3.0.3CVE List
  • apache-superset, PyPIfrom first release, fixed in 3.0.3OSV
  • apache-superset, PyPI0.34.0OSV
  • apache-superset, PyPI0.34.1OSV
  • apache-superset, PyPI0.35.1OSV
  • apache-superset, PyPI0.35.2OSV
  • apache-superset, PyPI0.36.0OSV
  • apache-superset, PyPI0.37.0OSV
  • apache-superset, PyPI0.37.1OSV
  • apache-superset, PyPI0.37.2OSV
  • apache-superset, PyPI0.38.0OSV
  • apache-superset, PyPI0.38.1OSV
  • apache-superset, PyPI1.0.0OSV
  • apache-superset, PyPI1.0.1OSV
  • apache-superset, PyPI1.1.0OSV
  • apache-superset, PyPI1.2.0OSV
  • apache-superset, PyPI1.3.0OSV
  • apache-superset, PyPI1.3.1OSV
  • apache-superset, PyPI1.3.2OSV
  • apache-superset, PyPI1.4.0OSV
  • apache-superset, PyPI1.4.1OSV
  • apache-superset, PyPI1.4.2OSV
  • apache-superset, PyPI1.5.0OSV
  • apache-superset, PyPI1.5.1OSV
  • apache-superset, PyPI1.5.2OSV
  • apache-superset, PyPI1.5.3OSV
  • apache-superset, PyPI2.0.0OSV
  • apache-superset, PyPI2.0.1OSV
  • apache-superset, PyPI2.1.0OSV
  • apache-superset, PyPI2.1.1OSV
  • apache-superset, PyPI2.1.1rc1OSV
  • apache-superset, PyPI2.1.1rc2OSV
  • apache-superset, PyPI2.1.1rc3OSV
  • apache-superset, PyPI2.1.2OSV
  • apache-superset, PyPI2.1.3OSV
  • apache-superset, PyPI3.0.0OSV
  • apache-superset, PyPI3.0.0rc1OSV
  • apache-superset, PyPI3.0.0rc2OSV
  • apache-superset, PyPI3.0.0rc3OSV
  • apache-superset, PyPI3.0.0rc4OSV
  • apache-superset, PyPI3.0.1OSV
  • apache-superset, PyPI3.0.2OSV

References 5