Live › vulnerability › CVE-2023-49657
Go to dashboardApache Superset before 3.0.3 lets a user with chart or dashboard create/update permission store a script or crafted HTML snippet that runs in other users' browsers. An attacker can act as the victim inside Superset, such as reading or changing data the victim can see.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 15:18 UTC, 0h before NVD. All times on this page are UTC.
Teams running self-hosted Apache Superset versions before 3.0.3 where some users can create or edit charts or dashboards. The exposure comes from stored content that other users then view. Instances where every user is read-only on charts and dashboards, or that are on 3.0.3 or later, are not affected by this flaw.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| apache-superset | pypi | < 3.0.3 | 3.0.3 |
| apache superset | vendor | < 3.0.3 | 3.0.3 |
pip show apache-superset, and confirm it is below 3.0.3.TALISMAN_CONFIG in superset_config.py sets the content_security_policy shown in the advisory.apache-superset to 3.0.3 or later.TALISMAN_CONFIG content security policy from the advisory (the sample in the source has broken quoting and must be corrected before use).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A stored cross-site scripting (XSS) vulnerability exists in Apache Superset before 3.0.3. An authenticated attacker with create/update permissions on charts or dashboards could store a script or add a specific HTML snippet that would act as a stored XSS.
For 2.X versions, users should change their config to include:
TALISMAN_CONFIG = { "content_security_policy": { "base-uri": ["'self'"], "default-src": ["'self'"], "img-src": ["'self'", "blob:", "data:"], "worker-src": ["'self'", "blob:"], "connect-src": [ "'self'", " https://api.mapbox.com" https://api.mapbox.com" ;, " https://events.mapbox.com" https://events.mapbox.com" ;, ], "object-src": "'none'", "style-src": [ "'self'", "'unsafe-inline'", ], "script-src": ["'self'", "'strict-dynamic'"], }, "content_security_policy_nonce_in": ["script-src"], "force_https": False, "session_cookie_secure": False, }
This page as .md · .json · in your agent: get_signal("CVE-2023-49657")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.