{"id":"CVE-2021-27907","aliases":["BIT-superset-2021-27907","EUVD-2021-0019","GHSA-w358-rj93-r5qv","PYSEC-2021-127"],"status":"published","title":"Apache Superset stored XSS on Dashboard markdown","description":"Apache Superset up to and including 0.38.0 allowed the creation of a Markdown component on a Dashboard page for describing chart's related information. Abusing this functionality, a malicious user could inject javascript code executing unwanted action in the context of the user's browser. The javascript code will be automatically executed (Stored XSS) when a legitimate user surfs on the dashboard page. The vulnerability is exploitable creating a “div” section and embedding in it a “svg” element with javascript code.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.86393,"percentile":0.99738,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2021-03-05T11:35:15Z","modified":"2026-10-24T10:30:36Z","fixes":[{"ecosystem":"PyPI","package":"apache-superset","fixed_in":["0.38.1"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"superset","fixed_in":["0.38.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"apache-superset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.38.0"},{"fixed":"0.38.1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"superset","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.38.1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"apache-superset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.38.1"}]}],"versions":["0.34.0","0.34.1","0.35.1","0.35.2","0.36.0","0.37.0","0.37.1","0.37.2","0.38.0"]},{"source":"osv","ecosystem":"PyPI","package":"apache-superset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.38.1"}]}],"versions":["0.34.0","0.34.1","0.35.1","0.35.2","0.36.0","0.37.0","0.37.1","0.37.2","0.38.0"]}],"products":[{"vendor":"apache","product":"superset"},{"vendor":"apache software foundation","product":"apache superset"}],"references":[{"url":"https://lists.apache.org/thread.html/r09293fb09f1d617f0d2180c42210e739e2211f8da9bc5c1873bea67a%40%3Cdev.superset.apache.org%3E","tags":["x_refsource_MISC","mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27907","tags":["web","advisory"]},{"url":"https://lists.apache.org/thread.html/r09293fb09f1d617f0d2180c42210e739e2211f8da9bc5c1873bea67a@%3Cdev.superset.apache.org%3E","tags":["web"]},{"url":"https://github.com/advisories/GHSA-w358-rj93-r5qv","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/apache-superset/PYSEC-2021-127.yaml","tags":["web"]},{"url":"https://github.com/apache/superset","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2021-27907","title":"Apache Superset stored XSS on Dashboard markdown","description":"Apache Superset up to and including 0.38.0 allowed the creation of a Markdown component on a Dashboard page for describing chart's related information. Abusing this functionality, a malicious user could inject javascript code executing unwanted action in the context of the user's browser. The javascript code will be automatically executed (Stored XSS) when a legitimate user surfs on the dashboard page. The vulnerability is exploitable creating a “div” section and embedding in it a “svg” element with javascript code.","status":"published","published":"2021-03-05T11:35:15Z","modified":"2025-02-13T16:27:58.281Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:33:04.679189Z"}],"euvd":[{"id":"EUVD-2021-0019","description":"Apache Superset up to and including 0.38.0 allowed the creation of a Markdown component on a Dashboard page for describing chart's related information. Abusing this functionality, a malicious user could inject javascript code executing unwanted action in the context of the user's browser. The javascript code will be automatically executed (Stored XSS) when a legitimate user surfs on the dashboard page. The vulnerability is exploitable creating a “div” section and embedding in it a “svg” element with javascript code.","status":"published","published":"2021-03-05T11:35:15Z","modified":"2025-02-13T16:27:58Z","cvss":[{"version":"","score":0,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"none"}],"updated_at":"2026-11-03T00:03:53.290549Z"}],"ghsa":[{"id":"GHSA-w358-rj93-r5qv","title":"Apache Superset Stored XSS on Dashboard markdown","description":"Apache Superset up to and including 0.38.0 allowed the creation of a Markdown component on a Dashboard page for describing chart's related information. Abusing this functionality, a malicious user could inject javascript code executing unwanted action in the context of the user's browser. The javascript code will be automatically executed (Stored XSS) when a legitimate user surfs on the dashboard page. The vulnerability is exploitable creating a “div” section and embedding in it a “svg” element with javascript code.","status":"published","published":"2022-05-24T22:29:00Z","modified":"2023-08-31T16:25:04Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:02.095916Z"}],"nvd":[{"id":"CVE-2021-27907","description":"Apache Superset up to and including 0.38.0 allowed the creation of a Markdown component on a Dashboard page for describing chart's related information. Abusing this functionality, a malicious user could inject javascript code executing unwanted action in the context of the user's browser. The javascript code will be automatically executed (Stored XSS) when a legitimate user surfs on the dashboard page. The vulnerability is exploitable creating a “div” section and embedding in it a “svg” element with javascript code.","status":"published","published":"2021-03-05T12:15:12.16Z","modified":"2026-06-17T03:45:35.67Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:06:50.399901Z"}],"osv":[{"id":"CVE-2021-27907","description":"Apache Superset up to and including 0.38.0 allowed the creation of a Markdown component on a Dashboard page for describing chart's related information. Abusing this functionality, a malicious user could inject javascript code executing unwanted action in the context of the user's browser. The javascript code will be automatically executed (Stored XSS) when a legitimate user surfs on the dashboard page. The vulnerability is exploitable creating a “div” section and embedding in it a “svg” element with javascript code.","status":"published","published":"2021-03-05T12:15:12.16Z","modified":"2026-10-24T10:30:36.511652797Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:19.129331Z"},{"id":"GHSA-w358-rj93-r5qv","title":"Apache Superset Stored XSS on Dashboard markdown","description":"Apache Superset up to and including 0.38.0 allowed the creation of a Markdown component on a Dashboard page for describing chart's related information. Abusing this functionality, a malicious user could inject javascript code executing unwanted action in the context of the user's browser. The javascript code will be automatically executed (Stored XSS) when a legitimate user surfs on the dashboard page. The vulnerability is exploitable creating a “div” section and embedding in it a “svg” element with javascript code.","status":"published","published":"2022-05-24T22:29:00Z","modified":"2025-02-05T09:11:57.593021Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:58.04805Z"},{"id":"BIT-superset-2021-27907","title":"Apache Superset stored XSS on Dashboard markdown","description":"Apache Superset up to and including 0.38.0 allowed the creation of a Markdown component on a Dashboard page for describing chart's related information. Abusing this functionality, a malicious user could inject javascript code executing unwanted action in the context of the user's browser. The javascript code will be automatically executed (Stored XSS) when a legitimate user surfs on the dashboard page. The vulnerability is exploitable creating a “div” section and embedding in it a “svg” element with javascript code.","status":"published","published":"2025-02-05T07:29:57.911Z","modified":"2026-09-08T08:48:19.565540907Z","updated_at":"2026-11-02T15:28:35.51001Z"},{"id":"PYSEC-2021-127","description":"Apache Superset up to and including 0.38.0 allowed the creation of a Markdown component on a Dashboard page for describing chart's related information. Abusing this functionality, a malicious user could inject javascript code executing unwanted action in the context of the user's browser. The javascript code will be automatically executed (Stored XSS) when a legitimate user surfs on the dashboard page. The vulnerability is exploitable creating a “div” section and embedding in it a “svg” element with javascript code.","status":"published","published":"2021-03-05T12:15:00Z","modified":"2025-02-05T09:11:57.593021Z","updated_at":"2026-11-02T15:52:52.682031Z"}]}}