CVE-2020-13948: Apache Superset Arbitrary Code Execution
Summary
CVE-2020-13948: While investigating a bug report on Apache Superset, it was determined that an authenticated user could craft requests via a number of templated text fields in the product that would allow arbitrary access to Python’s os... Affects apache-superset versions < 0.37.1. Fixed in 0.37.1. How to fix ↓
Also tracked for
- superset · Bitnami
The same CVE-2020-13948 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Superset is an open-source data exploration and visualization platform. It provides a user-friendly interface for creating and sharing interactive dashboards, charts, and reports. The platform is written in Python and utilizes various libraries and frameworks to enable data analysis and visualization. However, versions prior to 0.37.1 are vulnerable to an arbitrary code execution vulnerability.
Vulnerability Detail
The vulnerability in Apache Superset allows an authenticated user to exploit templated text fields in the product, leading to arbitrary access to Python's os package within the web application process. This allows the user to perform various unauthorized actions, such as listing and accessing files, environment variables, and process information. The user can also set environment variables, create and update files in writable folders, and execute arbitrary programs accessible by the web process. Essentially, the user gains full control over the web application process and can perform any operation available through the os package.
How To Fix
Latest published version: 6.1.0 as of 23 Oct 2026
pip install --upgrade "apache-superset==6.1.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.37.1
This is the first release that contains the fix.
pip install --upgrade "apache-superset==0.37.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the affected templated text fields or disable the functionality that allows user input to be used in templated fields. This can help mitigate the risk of exploitation until the upgrade to a patched version is performed. Here is an example of how to disable the functionality in the Superset configuration file (superset_config.py):
ENABLE_TEMPLATE_PROCESSING = False
Conclusion
The arbitrary code execution vulnerability in Apache Superset can be mitigated by upgrading to version 0.37.1 or later. It is important to promptly apply the necessary patches to ensure the security of the application. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apache-superset →
FAQ
Apache Superset is an open-source data exploration and visualization platform that allows users to create interactive dashboards, charts, and reports.
The vulnerability allows an authenticated user to execute arbitrary code within the web application process, potentially leading to unauthorized access, data leakage, and system compromise.
Versions prior to 0.37.1 are affected by this vulnerability.
To fix this vulnerability, upgrade Apache Superset to version 0.37.1 or later.
Yes, as a temporary workaround, you can disable the functionality that allows user input to be used in templated fields.
Related vulnerabilities
Recent vulnerabilities recorded for apache-superset.
