PT-2025-33271 · Apache · Apache Superset

Jobar + 2 · Published 2025-08-13 · Updated 2025-08-18 · CVE-2025-55672

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Apache Superset versions prior to 5.0.0

Description: A stored Cross-Site Scripting (XSS) issue exists in the chart visualization feature. An authenticated user with chart editing permissions can inject a malicious payload into a column's label. This payload is not properly sanitized and is executed in the victim's browser when hovering over the chart, potentially leading to session hijacking or the execution of arbitrary commands on behalf of the user.

Recommendations: Upgrade to version 5.0.0.

Fix

XSS

Weakness Enumeration

CWE-80

Related Identifiers

BDU:2025-10093

BIT-SUPERSET-2025-55672

CVE-2025-55672

GHSA-FJ97-2V9X-W5M4

Affected Products

Apache Superset

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-55672 · Security Note
• https://osv.dev/vulnerability/GHSA-fj97-2v9x-w5m4 · Vendor Advisory
• https://lists.apache.org/thread/rvh7fdjfzxzjhcfwoz7twc2brhvochdj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-55672 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-superset-2025-55672 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-55672 · Security Note
• https://bdu.fstec.ru/vul/2025-10093 · Security Note
• https://github.com/apache/superset · Note
• https://twitter.com/CVEnew/status/1956021913689497952 · Twitter Post
• http://openwall.com/lists/oss-security/2025/08/14/4 · Note
• https://twitter.com/oss_security/status/1956543481024848178 · Twitter Post