Stored Cross-Site Scripting Vulnerability in Apache Superset by Apache

CVE-2025-55672

What is CVE-2025-55672?

A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization feature. Authenticated users with editing permissions can exploit this weakness by injecting malicious scripts into chart labels. When other users hover over the affected charts, these scripts are executed in their browsers, potentially resulting in session hijacking or unauthorized command execution. To mitigate this security risk, it is essential for users to upgrade to version 5.0.0 or later of Apache Superset, where this vulnerability has been addressed.

References