CVE-2021-32609: Apache Superset HTML Injection Vulnerability
Summary
CVE-2021-32609: Apache Superset up to and including 1.1 does not sanitize titles correctly on the Explore page. Affects apache-superset versions < 1.2.0. Fixed in 1.2.0. How to fix ↓
Also tracked for
- superset · Bitnami
The same CVE-2021-32609 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Superset is an open-source data exploration and visualization platform. It provides a user-friendly interface for creating and sharing interactive dashboards, charts, and reports. The platform allows users to connect to various data sources, perform data analysis, and generate visualizations. However, versions up to and including 1.1 of Apache Superset are vulnerable to an HTML injection attack on the Explore page. This vulnerability allows an attacker with Explore access to save a chart with a malicious title, injecting HTML (including scripts) into the page.
Vulnerability Detail
The HTML injection vulnerability in Apache Superset allows an attacker to inject arbitrary HTML code, including scripts, into the Explore page. By saving a chart with a malicious title, an attacker can execute arbitrary code within the context of the user's browser. This can lead to various security risks, such as cross-site scripting (XSS) attacks, session hijacking, and unauthorized data access. The vulnerability can be exploited by an attacker with Explore access, potentially compromising the confidentiality, integrity, and availability of the application and its data.
How To Fix
Latest published version: 6.1.0 as of 23 Oct 2026
pip install --upgrade "apache-superset==6.1.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.2.0
This is the first release that contains the fix.
pip install --upgrade "apache-superset==1.2.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to restrict Explore access to trusted users only. By limiting access to the Explore functionality, the risk of exploitation can be mitigated. Additionally, it is important to educate users about the potential risks of opening charts with suspicious or unexpected titles.
Conclusion
The HTML injection vulnerability in Apache Superset can be mitigated by upgrading to version 1.2.0 or later. Restricting Explore access and raising user awareness about the risks can provide temporary protection. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apache-superset →
FAQ
Apache Superset is an open-source data exploration and visualization platform that allows users to create interactive dashboards, charts, and reports.
The vulnerability allows an attacker to inject arbitrary HTML code, potentially leading to cross-site scripting (XSS) attacks, session hijacking, and unauthorized data access.
Apache Superset versions up to and including 1.1 are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade to Apache Superset version 1.2.0 or later.
A temporary workaround is to restrict Explore access to trusted users and educate users about the risks of opening charts with suspicious titles.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache-superset.
