VulnerabilityModified

CVE-2025-55672

A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization.

MEDIUM 5.3EPSS 0.68%

Does this matter?

Lower severity and a low EPSS score (0.68%). Track it; it rarely justifies an emergency change on its own.

Description

A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they hover over the chart, potentially leading to session hijacking or the execution of arbitrary commands on behalf of the user. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue.

CVSS 4.0: 5.3 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.68% probability · 51th percentile
CISA KEV: Not listed
Weakness: CWE-80
Affected: apache/superset
Source: security@apache.org

References

https://lists.apache.org/thread/rvh7fdjfzxzjhcfwoz7twc2brhvochdjMailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2025/08/14/4

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.