Vulnerability record · CVE-2021-27907 · published 5 March 2021
CVE-2021-27907: Apache Superset dashboard Markdown component stored XSS
Apache · Superset
Apache Superset up to and including 0.38.0 lets a user create a Markdown component on a dashboard page that can embed an SVG element containing JavaScript. Because the injected script is stored and runs automatically when another user views the dashboard, it is a stored cross-site scripting flaw. It matters because dashboards are shared, so one low-privileged author can run script in the browsers of other users.
Description
Apache Superset up to and including 0.38.0 allowed the creation of a Markdown component on a Dashboard page for describing chart's related information. Abusing this functionality, a malicious user could inject javascript code executing unwanted action in the context of the user's browser. The javascript code will be automatically executed (Stored XSS) when a legitimate user surfs on the dashboard page. The vulnerability is exploitable creating a “div” section and embedding in it a “svg” element with javascript code.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Automated analysis
high priorityStored XSS in a shared analytics platform with a very high EPSS score can compromise many users, though it requires an authenticated author and victim interaction.
What it is
Apache Superset up to and including 0.38.0 lets a user create a Markdown component on a dashboard page that can embed an SVG element containing JavaScript. Because the injected script is stored and runs automatically when another user views the dashboard, it is a stored cross-site scripting flaw. It matters because dashboards are shared, so one low-privileged author can run script in the browsers of other users.
Impact
An attacker can execute arbitrary JavaScript in the context of a victim's browser session, enabling actions such as session or data theft and unauthorized operations as the victim. The CVSS scope change indicates impact can extend beyond the vulnerable component.
Attack surface
Reached over the network through the dashboard Markdown component; the attacker needs a low-privileged authenticated account to create the component, and a victim must view the affected dashboard page.
Exploitation
Not listed in CISA KEV and no public exploit tag is present in the references, but EPSS is very high (0.86393, 99.7th percentile), indicating elevated predicted exploitation activity.
What to do
- Upgrade Apache Superset past 0.38.0 to a fixed release; patch first.
- If immediate upgrade is not possible, restrict who can create or edit dashboard Markdown components.
- Sanitize or disallow embedded SVG and script content in Markdown components.
- Apply a Content Security Policy that blocks inline script execution in the Superset UI.
Detection
- Search Superset dashboard definitions and metadata for Markdown components containing svg or script elements.
- Review audit logs for dashboard or Markdown component creation by unexpected or low-privileged users.
- Monitor browser or proxy logs for inline script execution anomalies on Superset dashboard pages.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2021-27907 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2021-27907), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
