AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

Apache SupersetGHSA-79x5-cv79-49rj

Apache Superset is vulnerable to Cross-Site Scripting (XSS)

Apache Superset

CVE-2022-43718 · Published Jan 16, 2023 · updated Jul 7, 2026

Medium5.4
No fix yet
GitHub advisory

Upload data forms do not correctly render user input leading to possible XSS attack vectors that can be performed by authenticated users with database connection update permissions. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

Affected versions

PackageAffectedFixed in
apache-superset
PyPI
<= 1.5.2No fix yet
<= 2.0.0No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-79
Also known as
BIT-superset-2022-43718, CVE-2022-43718, PYSEC-2026-777

More Apache Superset advisories

All Apache Superset
High 8.8Jan 16, 2023Apache Superset vulnerable to Cross-Site Request Forgery via legacy REST API endpointsCVE-2022-43719no fix yetMedium 5.4Jan 16, 2023Apache Superset vulnerable to Cross-site ScriptingCVE-2022-43717no fix yetMedium 5.4Jan 16, 2023Apache Superset's SQL Alchemy connector vulnerable to SQL InjectionCVE-2022-41703no fix yetMedium 5.3Jan 16, 2023Apache Superset has Improper Access ControlCVE-2022-45438no fix yetMedium 5.4Jan 16, 2023Apache Superset Open Redirect vulnerabilityCVE-2022-43721no fix yetMedium 5.4Jan 16, 2023Apache Superset vulnerable to InjectionCVE-2022-43720no fix yet