OS command injection in Apache Superset
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-78.
Summary
While investigating a bug report on Apache Superset, it was determined that an authenticated user could craft requests via a number of templated text fields in the product that would allow arbitrary access to Python’s `os` package in the web application process in versions < 0.37.1. It was thus possible for an authenticated user to list and access files, environment variables, and process information. Additionally it was possible to set environment variables for the current process, create and update files in folders writable by the web process, and execute arbitrary programs accessible by the web process. All other operations available to the `os` package in Python were also available, even if not explicitly enumerated in this CVE.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Apache Superset | Apache Superset < 0.37.1 | — | No fix listed | CNA |
| — | apache-superset (PyPI) | before 0.37.1 | 0.37.1 | Patch available | GHSA-cj7g-h7rf-h8j9 |
- Apache Superset Vendor— Affected Apache Superset < 0.37.1 Fixed in — No fix listed CNA
- apache-superset (PyPI) Vendor— Affected before 0.37.1 Fixed in 0.37.1 Patch available GHSA-cj7g-h7rf-h8j9
Remediation
- Fix · GHSA-cj7g-h7rf-h8j9 apache-superset (PyPI) Fixed in 0.37.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2020-13948
- 2026-10-03 Alias added: GHSA-cj7g-h7rf-h8j9
References
Advisory 2
Other 7
- [superset-notifications] 20201112 [GitHub] [incubator-superset] robdiciuccio commented on pull request #11617: feat: support 'chevron' library for templating as jinja alternative
- [superset-notifications] 20201112 [GitHub] [incubator-superset] ktmud commented on pull request #11617: feat: support 'chevron' library for templating as jinja alternative
- https://github.com/apache/superset/pull/11617#issuecomment-726204489
- https://github.com/apache/superset
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-superset/PYSEC-2020-222.yaml
- https://lists.apache.org/thread.html/r0e35c7c5672a6146b962840be5c1a7b7461c05a71cd7ecc62774d155@%3Cnotifications.superset.apache.org%3E
- https://lists.apache.org/thread.html/r4fc7115f6e63ac255c48fc68c0da592df55fe4be47cae6378d39ac22@%3Cnotifications.superset.apache.org%3E
More Apache Superset vulnerabilities
- TI-2023-12249 Apache Superset: Session validation vulnerability when using provided default SECRET_KEY KEVCVSS 3.1CRITICAL 9.8
- TI-2018-05798 Deserialization of untrusted data in Superset CVSS 3.0CRITICAL 9.8
- TI-2023-21408 Apache Superset: Privilege escalation with default examples database CVSS 3.1HIGH 8.8
- TI-2023-20410 Apache Superset: Possible Unauthorized Registration of SQLite Database Connections CVSS 3.1MEDIUM 6.5
- TI-2021-09242 Apache Superset stored XSS on Dashboard markdown CVSS 3.1MEDIUM 5.4
- TI-2021-09359 Apache Superset Open Redirect CVSS 3.1MEDIUM 6.1
Sources
- CVE-2020-13948 · CVE Program
- CVE-2020-13948 · NVD
- FIRST EPSS
- GHSA-cj7g-h7rf-h8j9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences