Skip to main content

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CVE-2025-55672

Medium
5.3/10

Summary

A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they hover over the chart, potentially leading to session hijacking or the execution of arbitrary commands on behalf of the user. This issue affects Apache Superset versions through 4.1.4 and versions 5.0.0rc1 through 5.0.0rc3.

  • LOW
  • NETWORK
  • LOW
  • CHANGED
  • REQUIRED
  • LOW
  • LOW
  • NONE

CWE-80 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

References

Advisory Timeline

  • Published