GHSA-8w7f-8pr9-xgwj

Suggest an improvement
Source
https://github.com/advisories/GHSA-8w7f-8pr9-xgwj
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/05/GHSA-8w7f-8pr9-xgwj/GHSA-8w7f-8pr9-xgwj.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-8w7f-8pr9-xgwj
Aliases
  • CVE-2025-48912
Published
2025-05-30T09:30:27Z
Modified
2025-06-03T01:19:18.286334Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Apache Superset: Improper authorization bypass on row level security via SQL Injection
Details

An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields. This allowed the execution of sub-queries to evade parsing defenses ultimately granting unauthorized access to data.

This issue affects Apache Superset: before 4.1.2.

Users are recommended to upgrade to version 4.1.2, which fixes the issue.

Database specific 
{
    "nvd_published_at": "2025-05-30T09:15:25Z",
    "cwe_ids": [
        "CWE-89"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2025-05-30T15:25:31Z"
}
References

Affected packages

PyPI / apache-superset

Package

Name
apache-superset
View open source insights on deps.dev
Purl
pkg:pypi/apache-superset

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.1.2

Affected versions

0.*

0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1

1.*

1.0.0
1.0.1
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3

2.*

2.0.0
2.0.1
2.1.0
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.1
2.1.2
2.1.3

3.*

3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.0
3.1.1
3.1.2
3.1.3

4.*

4.0.0rc1
4.0.0rc2
4.0.0
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.0
4.1.1rc1
4.1.1
4.1.2rc1