CVE-2025-55672: Apache Superset Stored XSS Vulnerability

CVE-2025-55672 Overview

CVE-2025-55672 is a stored Cross-Site Scripting (XSS) vulnerability in Apache Superset's chart visualization component. An authenticated user with permission to edit charts can inject a malicious payload into a column label. The application fails to sanitize the label before rendering it, causing the payload to execute in a victim's browser when they hover over the affected chart.

Successful exploitation can lead to session hijacking or execution of arbitrary actions on behalf of the authenticated victim. The issue is tracked under [CWE-80] (Improper Neutralization of Script-Related HTML Tags) and affects all Apache Superset releases prior to 5.0.0.

Critical Impact
Authenticated attackers with chart-edit permissions can persist JavaScript in column labels and hijack other users' Superset sessions.

Affected Products

Apache Superset versions prior to 5.0.0
Deployments where multiple users share dashboards or charts
Installations that grant chart-edit permissions to non-administrative roles

Discovery Timeline

2025-08-14 - CVE-2025-55672 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-55672

Vulnerability Analysis

The flaw resides in Apache Superset's chart visualization layer. When a chart is rendered, column labels are displayed inside tooltips that appear on hover. The rendering pipeline does not neutralize HTML or script-related characters embedded in these labels, allowing raw markup to reach the DOM.

An authenticated user with can_write on charts modifies a column label to contain a JavaScript payload. That payload is persisted with the chart definition in the backend metadata store. Any user who later views the chart and hovers over the affected element triggers execution of the attacker-supplied script in their browser session.

Because execution occurs in the victim's authenticated context, the attacker inherits the victim's Superset privileges. This enables theft of session cookies, exfiltration of query results, or issuing API calls such as creating new users and modifying database connections.

Root Cause

The root cause is missing output encoding of user-controlled column labels before they are inserted into the chart tooltip DOM. The vulnerability maps to [CWE-80], where the application treats attacker-controlled input as trusted HTML rather than plain text.

Attack Vector

Exploitation requires network access to the Superset web interface and an authenticated account with chart-edit permissions. No user interaction is required beyond a victim hovering over the compromised chart. The vulnerability is exploitable over standard HTTP/HTTPS and does not require local access or elevated privileges beyond chart authoring rights.

No public proof-of-concept exploit is currently listed in Exploit-DB, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities catalog. See the Apache mailing list advisory and the OpenWall OSS-Security post for vendor discussion.

Detection Methods for CVE-2025-55672

Indicators of Compromise

Column labels in chart metadata containing HTML tags such as <script>, <img>, or <svg> with inline event handlers.
Outbound requests from Superset user browsers to unexpected domains shortly after chart interaction.
Unexpected Superset API calls originating from user sessions immediately after loading dashboards.

Detection Strategies

Audit the slices table in the Superset metadata database for chart configurations containing script-related characters in column label fields.
Enable and review Superset action logs for chart edits performed by non-administrative accounts.
Deploy Content Security Policy (CSP) reporting endpoints to capture blocked inline script executions inside Superset pages.

Monitoring Recommendations

Monitor web application firewall (WAF) logs for POST requests to Superset chart-update endpoints containing HTML tag patterns.
Track authentication anomalies, including concurrent sessions or geolocation shifts that may indicate stolen session tokens.
Alert on new privileged Superset users or database connection changes created shortly after chart modifications.

How to Mitigate CVE-2025-55672

Immediate Actions Required

Upgrade Apache Superset to version 5.0.0 or later, which contains the sanitization fix.
Review and restrict roles that grant chart-edit permissions to the minimum set of trusted users.
Audit existing charts for suspicious column labels and remove or sanitize any that contain HTML markup.

Patch Information

The Apache Superset project addressed the issue in version 5.0.0. The fix adds proper output encoding for column labels rendered in chart tooltips. Refer to the Apache mailing list advisory for the official announcement and upgrade guidance.

Workarounds

If upgrading is not immediately possible, remove chart-edit permissions (can_write on Chart) from non-administrative roles.
Deploy a strict Content Security Policy that disallows inline script execution on Superset origins.
Place a WAF rule in front of Superset to reject chart configuration payloads containing HTML tag characters in label fields.

bash

# Upgrade Apache Superset to the patched release
pip install --upgrade "apache-superset>=5.0.0"
superset db upgrade
superset init