CVE-2021-32609: Improper Neutralization of Input During Web Page Generation in Apache Superset
Summary
CVE-2021-32609: Improper Neutralization of Input During Web Page Generation in Apache Superset. Affects apache-superset versions < 1.2. Fixed in 1.2. How to fix ↓
Also tracked for
- superset · Bitnami
The same CVE-2021-32609 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Superset is an open-source data exploration and visualization platform that allows users to create interactive dashboards, charts, and reports. It is widely used for data analysis and business intelligence purposes. However, versions up to and including 1.1 of Apache Superset are vulnerable to an issue that affects the sanitization of titles on the Explore page. This vulnerability enables an attacker with Explore access to save a chart with a malicious title, injecting HTML (including scripts) into the page.
Vulnerability Detail
The vulnerability in Apache Superset arises from the improper neutralization of input during web page generation. When a user with Explore access saves a chart with a malicious title, the input is not properly sanitized, allowing the injection of HTML and scripts into the page. This can lead to various security risks, including cross-site scripting (XSS) attacks. An attacker could exploit this vulnerability to execute arbitrary code, steal sensitive information, or perform other malicious actions within the context of the affected user's session.
How To Fix
Latest published version: 6.1.0 as of 23 Oct 2026
pip install --upgrade "apache-superset==6.1.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.2
This is the first release that contains the fix.
pip install --upgrade "apache-superset==1.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the Explore feature for users who do not require it. This can be achieved by modifying the access permissions or disabling the Explore functionality altogether. By limiting access to the Explore page, the risk of exploitation through this vulnerability can be mitigated. However, it is still advisable to apply the official fix by upgrading to a patched version of Apache Superset.
Conclusion
In conclusion, Apache Superset versions up to and including 1.1 are vulnerable to an improper neutralization of input during web page generation. This can allow an attacker to inject malicious HTML and scripts into the page, potentially leading to cross-site scripting attacks and unauthorized code execution. Users should upgrade to Apache Superset version 1.2 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apache-superset →
FAQ
Apache Superset is an open-source data exploration and visualization platform used for creating interactive dashboards, charts, and reports.
Versions up to and including 1.1 of Apache Superset are affected by this vulnerability.
This vulnerability allows an attacker with Explore access to inject malicious HTML and scripts into the page, potentially leading to cross-site scripting (XSS) attacks and unauthorized execution of arbitrary code.
To fix this vulnerability, it is recommended to upgrade to Apache Superset version 1.2 or later.
As a temporary workaround, users can disable the Explore feature for users who do not require it.
Related vulnerabilities
Recent vulnerabilities recorded for apache-superset.
