CVE-2025-55672CWE-80

Apache Superset: Stored XSS on charts metadata

Medium · published August 14, 2025

CVSS v4.0
5.3
EPSS
1%
Percentile
54.2
In the wild
Unconfirmed
What it is

A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they hover over the chart, potentially leading to session hijacking or the execution of arbitrary commands on behalf of the user.

This issue affects Apache Superset: before 5.0.0.

Users are recommended to upgrade to version 5.0.0, which fixes the issue.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS
0.00742 · 54.2th percentile
Weakness
CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Published
2025-08-14T13:17Z
EPSS history
Timeline
  • 14 AUG 13:17Z
    Apache Superset: Stored XSS on charts metadata
    cvelistv5