GHSA-jfxj-xf67-x723MediumCVSS 6.5

Apache Superset SQL injection vulnerability

Published
December 19, 2023
Last Modified
February 13, 2025

🔗 CVE IDs covered (1)

CVE-2023-49736 →

📋 Description

A where_in JINJA macro allows users to specify a quote, which combined with a carefully crafted statement would allow for SQL injection in Apache Superset.This issue affects Apache Superset: before 2.1.3, from 3.0.0 before 3.0.2.

Users are recommended to upgrade to version 2.1.3 or 3.0.2, which fixes the issue.

🎯 Affected products2

  • pip/apache-superset:< 2.1.3
  • pip/apache-superset:>= 3.0.0, < 3.0.2

🔗 References (7)