CVE-2025-55672: 
Wolfi vulnerability analysis and mitigation

A stored Cross-Site Scripting (XSS) vulnerability (CVE-2025-55672) was discovered in Apache Superset's chart visualization feature. The vulnerability affects Apache Superset versions before 5.0.0 and was disclosed on August 14, 2025. The issue allows authenticated users with chart editing permissions to inject malicious payloads into column labels that get executed when other users hover over the chart (NVD).

The vulnerability is classified as a stored XSS issue (CWE-80) with a CVSS v3.1 base score of 5.4 (Medium) and vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. Additionally, it has a CVSS v4.0 score of 5.3 (Medium) with vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N (NVD).

When exploited, this vulnerability could lead to session hijacking or the execution of arbitrary commands in the victim's browser context when they hover over a compromised chart. The attack requires the victim to interact with the malicious chart element (NVD).

Users are recommended to upgrade to Apache Superset version 5.0.0 or later, which contains the fix for this vulnerability. This is the primary mitigation strategy provided by the vendor (NVD).