# CVE-2023-49657: Cross-site Scripting in Apache superset

Source: https://junglewise.ai/threats/cve-2023-49657-cross-site-scripting-in-apache-superset  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-01-23  
License: CC BY 4.0 with a link back

CVE-2023-49657 · Severity: critical · CVSS 9.6 · Published 2024-01-23

A stored cross-site scripting (XSS) vulnerability exists in Apache Superset before 3.0.3. An authenticated attacker with create/update permissions on charts or dashboards could store a script or add a specific HTML snippet that would act as a stored XSS.

For 2.X versions, users should change their config to include:

TALISMAN_CONFIG = {
    "content_security_policy": {
        "base-uri": ["'self'"],
        "default-src": ["'self'"],
        "img-src": ["'self'", "blob:", "data:"],
        "worker-src": ["'self'", "blob:"],
        "connect-src": [
            "'self'",
            " https://api.mapbox.com" https://api.mapbox.com" ;,
            " https://events.mapbox.com" https://events.mapbox.com" ;,
        ],
        "object-src": "'none'",
        "style-src": [
            "'self'",
            "'unsafe-inline'",
        ],
        "script-src": ["'self'", "'strict-dynamic'"],
    },
    "content_security_policy_nonce_in": ["script-src"],
    "force_https": False,
    "session_cookie_secure": False,
}

Technologies: [apache-superset (PyPI)](https://junglewise.ai/threats/technologies/apache-superset). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2023-49657 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-49657 being exploited in the wild.

**How severe is CVE-2023-49657?** Critical severity, with a CVSS score of 9.6, published 23 January 2024.

**Which products and versions are affected?** apache-superset (PyPI) < 3.0.3, ECOSYSTEM:introduced=0,fixed=3.0.3.

**Is there a fix for CVE-2023-49657?** Yes. apache-superset (PyPI): upgrade to 3.0.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2023-49657?** Check whether you run apache-superset (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- apache-superset (PyPI): upgrade to 3.0.3 or later

  ```sh
  pip install "apache-superset>=3.0.3"
  ```


## Affected products

- apache-superset (PyPI) < 3.0.3, ECOSYSTEM:introduced=0,fixed=3.0.3

## Identifiers

- CVE-2023-49657
- GHSA-rwhh-6x83-84v6
- PYSEC-2026-280

## Related threats

- [PYSEC-2026-2376 - Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections](https://junglewise.ai/threats/cve-2026-23984-apache-superset-read-only-bypass-via-improper-input-validation-on)
- [PYSEC-2026-2375 - Apache Superset allows authenticated users to view sensitive data without explicit permissions](https://junglewise.ai/threats/cve-2026-23983-apache-superset-allows-authenticated-users-to-view-sensitive-data)
- [PYSEC-2026-2373 - Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine](https://junglewise.ai/threats/cve-2026-23969-apache-superset-incomplete-disallowed-sql-functions-default-list)
- [PYSEC-2026-2374 - Apache Superset allows privileged users to conduct error-based SQL Injection](https://junglewise.ai/threats/cve-2026-23980-apache-superset-allows-privileged-users-to-conduct-error-based)
- [PYSEC-2026-2372 - Apache Superset Improper Authorization allows low-privileged users to bypass access controls](https://junglewise.ai/threats/cve-2026-23982-apache-superset-improper-authorization-in-dataset-access-controls)