Listen to this Post
How the CVE Works
The vulnerability arises due to insufficient input sanitization in Apache Superset’s chart visualization feature. An authenticated attacker with chart-editing permissions can inject malicious JavaScript into a column label. When another user views the chart and hovers over the affected column, the script executes in their browser. This stored XSS attack can lead to session hijacking, unauthorized actions, or data theft. The payload persists in the database, affecting all users who interact with the compromised chart.
DailyCVE Form
Platform: Apache Superset
Version: < 5.0.0
Vulnerability: Stored XSS
Severity: Moderate
Date: Aug 14, 2025
Prediction: Patch expected by Sep 10, 2025
What Undercode Say
Check Superset version
superset version
Verify patch
curl -s https://superset.apache.org/security | grep "CVE-2025-XXXX"
Exploit PoC (simulated)
POST /chart/save { "label": "<script>alert('XSS')</script>" }
How Exploit
1. Attacker logs in with edit permissions.
2. Injects malicious script into a chart label.
3. Victim triggers payload on hover.
Protection from this CVE
- Upgrade to Superset 5.0.0.
- Sanitize chart labels server-side.
- Restrict chart-editing permissions.
Impact
- Session hijacking.
- Unauthorized actions.
- Data exfiltration.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
