CVE-2023-43701: Apache Superset Cross-site Scripting vulnerability
Summary
CVE-2023-43701: Apache Superset Cross-site Scripting vulnerability. Affects apache-superset versions < 2.1.2. Fixed in 2.1.2. How to fix ↓
Also tracked for
- superset · Bitnami
The same CVE-2023-43701 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Superset is an open-source data exploration and visualization platform. It provides a user-friendly interface for creating and sharing interactive dashboards, charts, and reports. This vulnerability affects versions prior to 2.1.2 of Apache Superset. The vulnerability allows an authenticated malicious actor to store malicious code into Chart's metadata, which can be executed if a user accesses a specific deprecated API endpoint. This could potentially lead to cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability in Apache Superset arises from improper payload validation and an improper REST API response type. This allows an authenticated attacker to inject malicious code into Chart's metadata. When a user accesses a specific deprecated API endpoint, this code can be executed, leading to potential XSS attacks. The impact of this vulnerability is considered moderate, with a CVSS score of 4.3. It is important to note that this vulnerability only affects versions prior to 2.1.2 of Apache Superset.
How To Fix
Latest published version: 6.1.0 as of 23 Oct 2026
pip install --upgrade "apache-superset==6.1.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.1.2
This is the first release that contains the fix.
pip install --upgrade "apache-superset==2.1.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to upgrade to the fixed version of Apache Superset.
Conclusion
In conclusion, Apache Superset versions prior to 2.1.2 are vulnerable to a cross-site scripting (XSS) attack due to improper payload validation and an improper REST API response type. To mitigate this vulnerability, it is crucial to upgrade to Apache Superset version 2.1.2 or later. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for apache-superset →
FAQ
Apache Superset is an open-source data exploration and visualization platform that allows users to create interactive dashboards, charts, and reports.
The vulnerability allows an authenticated attacker to inject malicious code into Chart's metadata, potentially leading to cross-site scripting (XSS) attacks.
Versions prior to 2.1.2 of Apache Superset are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade to Apache Superset version 2.1.2 or later.
There is no specific workaround mentioned for this vulnerability. Upgrading to the fixed version is the recommended approach.
Related vulnerabilities
Recent vulnerabilities recorded for apache-superset.
