Stored Cross-Site Scripting Vulnerability in Apache Superset by Apache
CVE-2025-55672

5.3MEDIUM

Key Information:

Vendor

Apache
Status
Apache Superset
Vendor
CVE Published:
14 August 2025

What is CVE-2025-55672?

A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization feature. Authenticated users with editing permissions can exploit this weakness by injecting malicious scripts into chart labels. When other users hover over the affected charts, these scripts are executed in their browsers, potentially resulting in session hijacking or unauthorized command execution. To mitigate this security risk, it is essential for users to upgrade to version 5.0.0 or later of Apache Superset, where this vulnerability has been addressed.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Apache Superset 0 < 5.0.0

References

https://lists.apache.org/thread/rvh7fdjfzxzjhcfwoz7twc2br...
vendor-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Pedro Sousa
Jobar
Mehmet Yavuz
JSON
.