AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Apache SupersetGHSA-fpmr-qmgh-42x2

Apache Superset vulnerable to Injection

Apache Superset

CVE-2022-43720 · Published Jan 16, 2023 · updated Jul 7, 2026

Medium5.4
No fix yet
GitHub advisory

An authenticated attacker with write CSS template permissions can create a record with specific HTML tags that will not get properly escaped by the toast message displayed when a user deletes that specific CSS template record. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

Affected versions

PackageAffectedFixed in
apache-superset
PyPI
<= 1.5.2No fix yet
<= 2.0.0No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-74
Also known as
BIT-superset-2022-43720, CVE-2022-43720, PYSEC-2026-782

More Apache Superset advisories

All Apache Superset
High 8.8Jan 16, 2023Apache Superset vulnerable to Cross-Site Request Forgery via legacy REST API endpointsCVE-2022-43719no fix yetMedium 5.4Jan 16, 2023Apache Superset is vulnerable to Cross-Site Scripting (XSS)CVE-2022-43718no fix yetMedium 5.4Jan 16, 2023Apache Superset vulnerable to Cross-site ScriptingCVE-2022-43717no fix yetMedium 5.4Jan 16, 2023Apache Superset's SQL Alchemy connector vulnerable to SQL InjectionCVE-2022-41703no fix yetMedium 5.3Jan 16, 2023Apache Superset has Improper Access ControlCVE-2022-45438no fix yetMedium 5.4Jan 16, 2023Apache Superset Open Redirect vulnerabilityCVE-2022-43721no fix yet