CVE-2025-55672: Apache Superset Stored XSS Vulnerability in Chart Visualization
Summary
CVE-2025-55672: Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerability. Affects apache-superset versions < 5.0.0. Fixed in 5.0.0. How to fix ↓
Also tracked for
- superset · Bitnami
The same CVE-2025-55672 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Superset is an open-source data visualization and business intelligence tool that allows users to create interactive dashboards and charts. It is widely used for its ability to connect to various data sources and provide powerful analytics capabilities. However, like many web applications, it is susceptible to security vulnerabilities, including Cross-Site Scripting (XSS), which can compromise user data and application integrity.
Vulnerability Detail
A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization feature. This vulnerability arises when an authenticated user with permissions to edit charts injects a malicious payload into a column's label. The application fails to properly sanitize this input, allowing the payload to execute in the browser of any user who hovers over the affected chart. This can lead to session hijacking or the execution of arbitrary commands on behalf of the user, posing a significant security risk.
How To Fix
Latest published version: 6.1.0 as of 23 Oct 2026
pip install --upgrade "apache-superset==6.1.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.0.0
This is the first release that contains the fix.
pip install --upgrade "apache-superset==5.0.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict permissions for editing charts to trusted users only, minimizing the risk of malicious payloads being injected into chart labels.
Conclusion
The stored XSS vulnerability in Apache Superset's chart visualization poses a moderate security risk that can be exploited by malicious users. It is crucial for users to upgrade to version 5.0.0 or later to protect their applications from potential attacks. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for apache-superset →
FAQ
The vulnerability is a stored Cross-Site Scripting (XSS) issue that allows attackers to inject malicious scripts into chart labels.
Any user of Apache Superset prior to version 5.0.0 who has permissions to edit charts may be affected.
The vulnerability can lead to session hijacking and the execution of arbitrary commands in the context of the affected user.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If an immediate upgrade is not possible, restrict editing permissions for charts to trusted users to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for apache-superset.
