Apache Superset Cross-site Scripting vulnerability

CVE-2023-43701 · Published Nov 27, 2023 · updated Jul 7, 2026

Medium4.3

Fix: upgrade to 2.1.2 or later

Improper payload validation and an improper REST API response type, made it possible for an authenticated malicious actor to store malicious code into Chart's metadata, this code could get executed if a user specifically accesses a specific deprecated API endpoint. This issue affects Apache Superset versions prior to 2.1.2.

Users are recommended to upgrade to version 2.1.2, which fixes this issue.

Affected versions

Package	Affected	Fixed in
apache-superset PyPI	< 2.1.2	2.1.2

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Severity from: GitHub (reviewed advisory)
Weakness: CWE-79
Also known as: BIT-superset-2023-43701, CVE-2023-43701, PYSEC-2026-1190

More Apache Superset advisories

All Apache Superset

Medium 6.5Dec 19, 2023

Apache Superset SQL injection vulnerabilityCVE-2023-49736fixed in 2.1.3 +1 High 7.3Nov 28, 2023

Apache Superset - Elevation of PrivilegeCVE-2023-40610fixed in 2.1.2 Medium 5.4Nov 28, 2023

Apache Superset Open Redirect vulnerabilityCVE-2023-42502fixed in 3.0.0 Medium 4.3Nov 28, 2023

Apache Superset Exposure of Sensitive Information to an Unauthorized Actor vulnerabilityCVE-2023-42505fixed in 3.0.0 Medium 6.5Nov 28, 2023

Apache Superset Allocation of Resources Without Limits or Throttling vulnerabilityCVE-2023-42504fixed in 3.0.0 Medium 4.3Nov 27, 2023

Apache Superset has Incorrect Default PermissionsCVE-2023-42501fixed in 2.1.2