Skip to content
RequestGuard Vulnerabilities
Pricing
Vulnerability intelligence PyPI

apache-superset

A modern, enterprise-ready business intelligence web application

PyPI latest 6.1.0 Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1. Definitions. "License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document. "Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License. "Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity. "You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License. "Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files. "Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types. "Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below). "Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof. "Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution." "Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work. 2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form. 3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed. 4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions: (a) You must give any other recipients of the Work or Derivative Works a copy of this License; and (b) You must cause any modified files to carry prominent notices stating that You changed the files; and (c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and (d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License. You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License. 5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions. 6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file. 7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License. 8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages. 9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability. END OF TERMS AND CONDITIONS APPENDIX: How to apply the Apache License to your work. To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same "printed page" as the copyright notice for easier identification within third-party archives. Copyright [yyyy] [name of copyright owner] Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. ============================================================================ APACHE SUPERSET SUBCOMPONENTS: The Apache Superset project contains subcomponents with separate copyright notices and license terms. Your use of the source code for the these subcomponents is subject to the terms and conditions of the following licenses. ======================================================================== Third party SIL Open Font License v1.1 (OFL-1.1) ======================================================================== (SIL OPEN FONT LICENSE Version 1.1) The Inter font family (https://github.com/rsms/inter) (SIL OPEN FONT LICENSE Version 1.1) The Fira Code font family (https://github.com/tonsky/FiraCode)

Evidence path

Version, exploitation, severity

RequestGuard keeps these facts separate. A KEV match refers to a CVE, while OSV supplies the package and version match.

1

Latest version

6.1.0

No matching published advisory returned

2

Known exploitation

No KEV match

Checked by exact CVE identifier

3

Highest advisory severity

Critical

66 active advisories

Check an exact version

The registry confirms the version, then OSV checks advisories for that exact value.

Published records

Advisories

66
GHSA-g49j-j489-3xpf high

Apache Superset incorrect write permissions vulnerability

Affected range

ECOSYSTEM: introduced 0; fixed 2.1.3ECOSYSTEM: introduced 3.0.0; fixed 3.0.2ECOSYSTEM: introduced 0; fixed 2.1.3; introduced 3.0.0; fixed 3.0.2

Fixed versions: 2.1.3, 3.0.2

CVE-2023-49734 Source ↗Source ↗
GHSA-7222-r37x-8q3m high

Apache Superset vulnerable to Cross-Site Request Forgery via legacy REST API endpoints

Affected range

ECOSYSTEM: introduced 0; last affected 1.5.2ECOSYSTEM: introduced 0; fixed 1.5.3; introduced 2.0.0; fixed 2.0.1

Fixed versions: 1.5.3, 2.0.1

CVE-2022-43719 Source ↗Source ↗
GHSA-mhpq-m962-mg92 moderate

Apache Superset allows authenticated users to discover metadata about datasources they don't have permission to access

Affected range

ECOSYSTEM: introduced 0; fixed 5.0.0

Fixed versions: 5.0.0

CVE-2025-55675 Source ↗Source ↗
GHSA-9g5x-mm39-wg9r moderate

Apache Superset data query improperly discloses database schema information to low-privileged guest user

Affected range

ECOSYSTEM: introduced 0; fixed 4.1.3.post1

Fixed versions: 4.1.3.post1

CVE-2025-55673 Source ↗Source ↗
Show 41 more advisories
GHSA-vv65-fjfj-4736 Apache Superset has Incorrect Default Permissions
GHSA-2q6j-vpvr-6pvj Apache Superset vulnerable to improper SQL authorization
GHSA-fgpw-4w69-j256 Apache Superset Exposure of Sensitive Information to an Unauthorized Actor vulnerability
GHSA-cmjc-52fg-9f7j Apache Superset vulnerable to Exposure of Sensitive Information
GHSA-5474-f7g5-273q Apache Superset: Improper validation of SQL statements allows for unauthorized access to data
GHSA-v594-2c97-hx38 Apache Superset vulnerable to improper data authorization
GHSA-wr6g-9wcr-cmqj Apache Superset: Improper data authorization when creating a new dataset
GHSA-hcr7-cqwc-q5gq Apache Superset server arbitrary file read
GHSA-m6jm-3v38-76j4 Apache Superset: Improper Neutralization of custom SQL on embedded context
GHSA-299q-3p96-5898 Apache Superset Incorrect Authorization vulnerability
GHSA-3v9r-885j-762g Apache Superset: Improper authorization validation on dashboards and charts import
GHSA-fj97-2v9x-w5m4 Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerability
GHSA-hc74-9vjm-c9xv Apache Superset Open Redirect vulnerability
GHSA-95mg-jgfx-54v9 Apache Superset uncontrolled resource consumption
GHSA-2cx9-54hp-r698 Apache Superset: Error verbosity exposes metadata in analytics databases
GHSA-h7r6-8qmm-hj5r Apache Superset: Improper error handling on alerts
GHSA-3hp7-4qq4-v5c6 Apache Superset Allocation of Resources Without Limits or Throttling vulnerability
GHSA-fj4x-m62j-wvwg Apache Superset Deserialization of Untrusted Data vulnerability
GHSA-fxjg-28fm-pfxh Apache Superset Server-Side Request Forgery vulnerability
GHSA-4fg9-5w46-xmrj Apache Superset Server Side Request Forgery vulnerability
GHSA-95ch-p3gw-23qg Apache Superset has incorrect authorization check
GHSA-9832-mgg4-3gr6 Apache Superset has improper default REST API permission for Gamma users
GHSA-fxgf-3xh6-m2pp Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions
GHSA-wq8q-99p5-xfrw Apache Superset Cross-site Scripting vulnerability
GHSA-jfxj-xf67-x723 Apache Superset SQL injection vulnerability
GHSA-7jhg-8m74-6f6g Apache Superset vulnerable to Improper Authorization
GHSA-cpvx-2365-466c Apache Superset may expose internal traces on REST API endpoints
GHSA-9qc3-p9jq-2x27 Apache Superset users may incorrectly create resources using the import charts feature
GHSA-79x5-cv79-49rj Apache Superset is vulnerable to Cross-Site Scripting (XSS)
GHSA-cxvp-3frm-3876 Apache Superset's SQL Alchemy connector vulnerable to SQL Injection
GHSA-9f88-wg5r-947j Apache Superset vulnerable to Cross-site Scripting
GHSA-fpmr-qmgh-42x2 Apache Superset vulnerable to Injection
GHSA-fcg4-pm6h-9xx2 Apache Superset Open Redirect vulnerability
GHSA-748r-5r8q-273m Apache Superset allows authenticated users to access metadata they have no permission to
GHSA-8f5j-mgx9-5hm5 Apache Superset has Improper Access Control
GHSA-fxjm-wvj9-9c39 Information disclosure in Apache Superset
GHSA-w358-rj93-r5qv Apache Superset Stored XSS on Dashboard markdown
GHSA-f8vc-f28w-x9c9 Apache Superset Cross-site Scripting (XSS) vulnerability on the Explore page
GHSA-p5w7-qmq6-pmjr Users able to query database metadata in Apache Superset
GHSA-9c29-9h4m-wg5p Users can view database names in Apache Superset
GHSA-h294-8fxm-m2pj Apache Superset allows authenticated users to view sensitive data without explicit permissions