CVE-2021-41971: Apache Superset SQL Injection Vulnerability in Template Processing

superset Updated 02 Oct 2025

Summary

05/02/2025

Disclosed on

CVE-2021-41971

CVE

Yes i

Fix available

High

Severity

Not published

CVSS Score

CVE-2021-41971: Possible SQL Injection when template processing is enabled. Affects superset versions < 1.3.1. Fixed in 1.3.1. How to fix ↓

Also tracked for

The same CVE-2021-41971 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

Apache Superset is an open-source data visualization and exploration platform designed to help users analyze and visualize data effectively. It provides a rich set of features, including a user-friendly interface, customizable dashboards, and support for various data sources. However, when configured with ENABLE_TEMPLATE_PROCESSING enabled, it becomes vulnerable to SQL injection attacks, allowing malicious users to manipulate SQL queries.

Vulnerability Detail

The vulnerability arises from the improper handling of user input when the ENABLE_TEMPLATE_PROCESSING feature is activated. An authenticated user can craft a malicious HTTP request containing a custom URL that exploits this weakness, leading to SQL injection. This can result in unauthorized access to sensitive data, data manipulation, or even complete system compromise. The vulnerability affects all versions of Apache Superset up to and including 1.3.0.

How To Fix

Minimum fixed version

1.3.1

This is the first release that contains the fix.

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

As a temporary workaround, disable the ENABLE_TEMPLATE_PROCESSING feature in your Superset configuration. This can be done by setting the following in your configuration file: 'ENABLE_TEMPLATE_PROCESSING = False'. This will mitigate the risk of SQL injection until a patch is applied.

Conclusion

The CVE-2021-41971 vulnerability in Apache Superset poses a significant risk when the ENABLE_TEMPLATE_PROCESSING feature is enabled. It is crucial for users to update to a patched version or disable this feature to protect against potential SQL injection attacks. Regular monitoring and vulnerability management practices, such as using tools like Vulert, can help maintain the security of your applications.

See every vulnerability recorded for superset →