Nick Barnes

A stored cross-site scripting (XSS) vulnerability exists in Apache Superset. An authenticated attacker with create/update permissions on charts or dashboards could store a script or add a specific HTML snippet that would act as a stored XSS. This could allow a remote attacker to conduct cross-site scripting attacks.

The issue is caused by improper payload validation and an improper REST API response type. This allows an authenticated malicious actor to store malicious code into Chart's metadata. The code can be executed if a user accesses a specific deprecated API endpoint.