Apache Superset up to and including 1.3.0 when configured with ENABLETEMPLATEPROCESSING on (disabled by default) allowed SQL injection when a malicious authenticated user sends an http request with a custom URL.
{ "nvd_published_at": "2021-10-18T15:15:00Z", "cwe_ids": [ "CWE-89" ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2022-06-21T20:09:32Z" }