---
id: CVE-2023-49657
aliases:
  - GHSA-rwhh-6x83-84v6
  - BIT-superset-2023-49657
  - PYSEC-2026-280
title: Cross-site Scripting in Apache superset
summary: Cross-site Scripting in Apache superset
severity: critical
cvss: 9.6
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N'
vendor: apache-superset
product: apache-superset
ecosystem: pip
affected:
  - apache-superset < 3.0.3
patched:
  - apache-superset 3.0.3
published: '2024-01-23'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T15:30:03.250296762Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-rwhh-6x83-84v6'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2023-49657'
  - url: 'https://github.com/apache/superset'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/apache-superset/PYSEC-2026-280.yaml
  - url: 'https://lists.apache.org/thread/wjyvz8om9nwd396lh0bt156mtwjxpsvx'
  - url: 'https://pypi.org/project/apache-superset'
  - url: 'http://www.openwall.com/lists/oss-security/2024/01/23/5'
  - url: 'https://github.com/advisories/GHSA-rwhh-6x83-84v6'
tags:
  - osv
  - pip
  - ghsa
epss: 0.00837
epssPercentile: 0.57559
cwe:
  - CWE-79
ingestedAt: '2026-10-27T16:11:58.734Z'
---

## Overview

A stored cross-site scripting (XSS) vulnerability exists in Apache Superset before 3.0.3. An authenticated attacker with create/update permissions on charts or dashboards could store a script or add a specific HTML snippet that would act as a stored XSS.

For 2.X versions, users should change their config to include:

TALISMAN_CONFIG = {
    "content_security_policy": {
        "base-uri": ["'self'"],
        "default-src": ["'self'"],
        "img-src": ["'self'", "blob:", "data:"],
        "worker-src": ["'self'", "blob:"],
        "connect-src": [
            "'self'",
            " https://api.mapbox.com" https://api.mapbox.com" ;,
            " https://events.mapbox.com" https://events.mapbox.com" ;,
        ],
        "object-src": "'none'",
        "style-src": [
            "'self'",
            "'unsafe-inline'",
        ],
        "script-src": ["'self'", "'strict-dynamic'"],
    },
    "content_security_policy_nonce_in": ["script-src"],
    "force_https": False,
    "session_cookie_secure": False,
}

## Affected packages

- `apache-superset < 3.0.3`

## Remediation

Upgrade to a patched release:

- `apache-superset 3.0.3`