CVE-2025-55672

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they hover over the chart, potentially leading to session hijacking or the execution of arbitrary commands on behalf of the user.

This issue affects Apache Superset: before 5.0.0.

Users are recommended to upgrade to version 5.0.0, which fixes the issue.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-80

Affected software

No affected versions have been published.

Timeline

Published
Aug 14, 2025
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-556734.3When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload.CVE-2025-556746.5A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker CVE-2025-556756.5Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authentiCVE-2025-556765.5Generation of error message containing sensitive information in Windows USB Video Driver allows an authorized attacker to disclose informatiCVE-2025-556777.8Untrusted pointer dereference in Windows Device Association Broker service allows an authorized attacker to elevate privileges locally.CVE-2025-556787.0Use after free in Windows DirectX allows an authorized attacker to elevate privileges locally.CVE-2025-556794.7Improper input validation in Windows Kernel allows an unauthorized attacker to disclose information locally.CVE-2025-55685.4The WpEvently plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in all versions up to, and includingCVE-2025-556807.0Time-of-check time-of-use (toctou) race condition in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileCVE-2025-556817.8Out-of-bounds read in Windows DWM allows an authorized attacker to elevate privileges locally.CVE-2025-556824.6Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physicaCVE-2025-556835.5Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose information locally.
CVE-2025-55672: Medium severity, CVSS 5.4 | Vulnix