CVE-2021-27907: Apache Superset Markdown Component Stored XSS
Summary
CVE-2021-27907: Apache Superset up to and including 0.38.0 allowed the creation of a Markdown component on a Dashboard page for describing chart's related information. Affects apache-superset versions < 0.38.1. Fixed in 0.38.1. How to fix ↓
Also tracked for
- superset · Bitnami
The same CVE-2021-27907 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Superset is an open-source data exploration and visualization platform. It allows users to create interactive dashboards and perform data analysis. The Markdown component in Apache Superset is used to provide additional information and descriptions for charts on a dashboard page. However, versions up to and including 0.38.0 are vulnerable to a stored cross-site scripting (XSS) attack. This allows a malicious user to inject JavaScript code into the Markdown component, which will be executed when a legitimate user views the dashboard page. The vulnerability can be exploited by creating a 'div' section and embedding a 'svg' element with malicious JavaScript code.
Vulnerability Detail
The vulnerability in Apache Superset allows an attacker to execute arbitrary JavaScript code in the context of a user's browser. This can lead to various malicious actions, such as stealing sensitive information, performing unauthorized actions on behalf of the user, or spreading malware. The stored XSS vulnerability is triggered when a user accesses a dashboard page containing the malicious Markdown component. The JavaScript code embedded in the component is automatically executed, compromising the user's browser.
How To Fix
Latest published version: 6.1.0 as of 23 Oct 2026
pip install --upgrade "apache-superset==6.1.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.38.1
This is the first release that contains the fix.
pip install --upgrade "apache-superset==0.38.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, users can mitigate the risk by disabling the Markdown component feature or implementing input validation and sanitization measures. Here is an example of how to disable the Markdown component in the Superset configuration file:
ENABLE_MARKDOWN_COMPONENT = False
By setting the ENABLE_MARKDOWN_COMPONENT variable to False, the vulnerable feature will be disabled, reducing the attack surface.
Conclusion
The stored cross-site scripting vulnerability in Apache Superset's Markdown component (CVE-2021-27907) allows an attacker to execute arbitrary JavaScript code in the context of a user's browser. This can lead to various security risks, including data theft and unauthorized actions. Users are advised to upgrade to Apache Superset version 0.38.1 or later to fix the vulnerability. Alternatively, they can disable the Markdown component or implement input validation and sanitization measures. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apache-superset →
FAQ
Apache Superset is an open-source data exploration and visualization platform that allows users to create interactive dashboards and perform data analysis.
A stored XSS vulnerability allows an attacker to inject malicious code into a web application, which is then stored and executed when a user accesses the affected page. This can lead to various security risks, such as unauthorized access, data theft, or browser exploitation.
The vulnerability in the Markdown component of Apache Superset allows a malicious user to inject JavaScript code into the component. When a legitimate user views a dashboard page containing the malicious component, the JavaScript code is executed in their browser, potentially compromising their security.
The stored XSS vulnerability in Apache Superset can lead to various malicious actions, including stealing sensitive information, performing unauthorized actions on behalf of the user, or spreading malware. It poses a significant risk to the security and integrity of the affected system.
To protect your Apache Superset installation, it is recommended to upgrade to version 0.38.1 or later, which includes a fix for the vulnerability. If immediate upgrade is not possible, you can mitigate the risk by disabling the Markdown component or implementing input validation and sanitization measures.
Related vulnerabilities
Recent vulnerabilities recorded for apache-superset.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
