CVE-2021-42250: Apache Superset Improper Output Neutralization
Summary
CVE-2021-42250: Improper output neutralization for Logs. Affects apache-superset versions < 1.3.2. Fixed in 1.3.2. How to fix ↓
Also tracked for
- superset · Bitnami
The same CVE-2021-42250 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Superset is an open-source data exploration and visualization platform. It provides a user-friendly interface for creating interactive dashboards and visualizations from various data sources. The vulnerability identified as CVE-2021-42250 allows an authenticated user to manipulate log entries or inject malicious content into the logs through a specific HTTP endpoint.
Vulnerability Detail
The vulnerability arises from a lack of proper output neutralization in Apache Superset's logging mechanism. This allows an authenticated user to forge log entries or inject malicious content into the logs. The impact of this vulnerability can range from log tampering to the injection of malicious code, potentially leading to unauthorized access, data manipulation, or other security breaches.
How To Fix
Latest published version: 6.1.0 as of 23 Oct 2026
pip install --upgrade "apache-superset==6.1.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.3.2
This is the first release that contains the fix.
pip install --upgrade "apache-superset==1.3.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to upgrade to the fixed version as soon as possible.
Conclusion
The CVE-2021-42250 vulnerability in Apache Superset allows authenticated users to manipulate logs or inject malicious content. To mitigate this vulnerability, it is crucial to upgrade to Apache Superset version 1.3.2 or later. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for apache-superset →
FAQ
Apache Superset is an open-source data exploration and visualization platform that allows users to create interactive dashboards and visualizations from various data sources.
The vulnerability allows an authenticated user to manipulate log entries or inject malicious content into the logs, potentially leading to unauthorized access, data manipulation, or other security breaches.
To fix this vulnerability, it is recommended to upgrade Apache Superset to version 1.3.2 or later.
There is no specific workaround mentioned for this vulnerability. It is advised to upgrade to the fixed version as soon as possible.
You can find more information about this vulnerability in the Apache Superset advisory database: [link to advisory database]
Related vulnerabilities
Recent vulnerabilities recorded for apache-superset.
