Apache Superset: Stored XSS on charts metadata

Vulnerability

Overview A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. The root cause is improper sanitization of column labels in chart metadata. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. When other users view the chart and hover over the affected element, the payload executes in their browser [1][3].

Exploitation

Conditions To exploit this vulnerability, an attacker must be an authenticated user with permissions to edit charts. No special network access or elevated privileges beyond chart editing are required. The attack does not require user interaction beyond normal chart viewing; simply hovering over the chart triggers the payload. The stored nature of the XSS means the malicious content persists until removed [1].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's session. This can lead to session hijacking, theft of sensitive data, or performing actions on behalf of the victim within the application. The impact is limited to the browser context of the victim, but can compromise the confidentiality and integrity of data accessible through the Superset interface [1][3].

Mitigation

The vulnerability affects Apache Superset versions before 5.0.0. Users are recommended to upgrade to version 5.0.0, which contains the fix that properly sanitizes column labels. No workarounds are mentioned in the advisories. The issue was reported by Pedro Sousa (coordinator), Jobar (finder), and Mehmet Yavuz (remediation developer) [1][3].