PYSEC-2026-779

vendorUSosv

Apache Superset vulnerable to Cross-site Scripting

view advisory published 2026-07-07Licence: CC-BY-4.0

Dashboard rendering does not sufficiently sanitize the content of markdown components leading to possible XSS attack vectors that can be performed by authenticated users with create dashboard permissions. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-43717US	medium5.4	1.29% (70th)	—	2023-01-16
Dashboard rendering does not sufficiently sanitize the content of markdown components leading to possible XSS attack vectors that can be performed by authenticated users with creat…

references

External citations — patches, advisories, analysis.

https://github.com/advisories/GHSA-9f88-wg5r-947jADVISORY
https://github.com/apache/supersetPACKAGE
https://lists.apache.org/thread/g6zy6vkpvkbj5mj32vmyzwol5ldtg9plWEB
https://nvd.nist.gov/vuln/detail/CVE-2022-43717ADVISORY
https://pypi.org/project/apache-supersetPACKAGE

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan