Critical severity9.8NVD Advisory· Published Apr 13, 2022· Updated Jun 17, 2026

CVE-2022-27479

Description

Apache Superset before 1.4.2 is vulnerable to SQL injection in chart data requests. Users should update to 1.4.2 or higher which addresses this issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
apache-supersetPyPI	< 1.4.2	1.4.2

Affected products

Apache/Superset2 versions
cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:*range: <1.4.2
- (no CPE)range: unspecified
osv-coords2 versions
pkg:bitnami/superset pkg:pypi/apache-superset
< 1.4.2+ 1 more
- (no CPE)range: < 1.4.2
- (no CPE)range: < 1.4.2

Patches

Vulnerability mechanics

References

www.openwall.com/lists/oss-security/2022/04/13/3nvdMailing ListThird Party AdvisoryWEB
github.com/advisories/GHSA-wh73-hpcg-v32jghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2022-27479ghsaADVISORY
github.com/pypa/advisory-database/tree/main/vulns/apache-superset/PYSEC-2022-188.yamlghsaWEB
lists.apache.org/thread/94th50j5d0y2fw7ysx0g7w3t6jk3z7q6nvdBroken LinkWEB
lists.apache.org/thread/ztb9b6jd9rngoxwvq8r4fhpp401o613ynvdBroken LinkWEB

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000