AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Apache SupersetGHSA-9f88-wg5r-947j

Apache Superset vulnerable to Cross-site Scripting

Apache Superset

CVE-2022-43717 · Published Jan 16, 2023 · updated Jul 7, 2026

Medium5.4
No fix yet
GitHub advisory

Dashboard rendering does not sufficiently sanitize the content of markdown components leading to possible XSS attack vectors that can be performed by authenticated users with create dashboard permissions. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

Affected versions

PackageAffectedFixed in
apache-superset
PyPI
<= 1.5.2No fix yet
<= 2.0.0No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-79
Also known as
BIT-superset-2022-43717, CVE-2022-43717, PYSEC-2026-779

More Apache Superset advisories

All Apache Superset
High 8.8Jan 16, 2023Apache Superset vulnerable to Cross-Site Request Forgery via legacy REST API endpointsCVE-2022-43719no fix yetMedium 5.4Jan 16, 2023Apache Superset is vulnerable to Cross-Site Scripting (XSS)CVE-2022-43718no fix yetMedium 5.4Jan 16, 2023Apache Superset's SQL Alchemy connector vulnerable to SQL InjectionCVE-2022-41703no fix yetMedium 5.3Jan 16, 2023Apache Superset has Improper Access ControlCVE-2022-45438no fix yetMedium 5.4Jan 16, 2023Apache Superset Open Redirect vulnerabilityCVE-2022-43721no fix yetMedium 5.4Jan 16, 2023Apache Superset vulnerable to InjectionCVE-2022-43720no fix yet