CVE-2022-27479: SQL injection in apache-superset
Summary
CVE-2022-27479: SQL injection in apache-superset. Affects apache-superset versions < 1.4.2. Fixed in 1.4.2. How to fix ↓
Also tracked for
- superset · Bitnami
The same CVE-2022-27479 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Superset is an open-source data exploration and visualization platform. It provides a user-friendly interface for creating interactive dashboards, charts, and reports. However, versions before 1.4.2 are vulnerable to SQL injection in chart data requests. This means that an attacker can manipulate the input parameters of a chart request to execute arbitrary SQL queries, potentially gaining unauthorized access to the underlying database.
Vulnerability Detail
The SQL injection vulnerability in Apache Superset allows an attacker to inject malicious SQL code into chart data requests. By crafting specially crafted input, an attacker can bypass input validation and execute arbitrary SQL queries. This can lead to unauthorized access, data manipulation, or even complete compromise of the underlying database. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Latest published version: 6.1.0 as of 23 Oct 2026
pip install --upgrade "apache-superset==6.1.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.2
This is the first release that contains the fix.
pip install --upgrade "apache-superset==1.4.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the latest version of Apache Superset as soon as possible.
Conclusion
Apache Superset versions before 1.4.2 are vulnerable to SQL injection, which can lead to unauthorized access and data manipulation. Users should update to version 1.4.2 or higher to fix this vulnerability. There is no known workaround for this issue. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apache-superset →
FAQ
Apache Superset is an open-source data exploration and visualization platform. It provides a user-friendly interface for creating interactive dashboards, charts, and reports.
SQL injection is a type of security vulnerability that allows an attacker to manipulate SQL queries through user input. By injecting malicious SQL code, an attacker can bypass input validation and execute arbitrary SQL queries.
The SQL injection vulnerability in Apache Superset can lead to unauthorized access, data manipulation, or even complete compromise of the underlying database. An attacker could extract sensitive data, modify or delete data, or perform other malicious actions.
You can use Vulert's playground (https://vulert.com/scanner) to check if your Apache Superset installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the Pipfile.lock file.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide guidance and assistance in fixing the vulnerability in your Apache Superset installation.
Related vulnerabilities
Recent vulnerabilities recorded for apache-superset.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
