-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| apache-superset | pip | < 2.1.2 | 2.1.2 |
PythonPythonMiggo AIRoot Cause AnalysisThe vulnerability stems from two key issues: 1) Insecure input handling in chart metadata updates (PUT) allowing XSS storage, and 2) Deprecated API endpoints (GET) returning unsanitized metadata with improper response types. The ChartRestApi class would logically contain these methods in Superset's REST API implementation. The combination of missing input validation in write operations and improper Content-Type headers in read operations creates the XSS chain. While exact code isn't visible, Superset's architecture and vulnerability description strongly suggest these REST handlers as the vulnerable components.
Ongoing coverage of React2Shell