StackRadarChart IndexLive demo

CVE-2021-27907

Medium

Advisory

Published 5 Mar 2021In the index since 6 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.4; base score, highest
EPSS: 0.864; 100th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 3; of 17,781 indexed, latest versions
Container images: 2; deployed by those charts
Fix available: 1 of 1; affected package

Apache Superset Stored XSS on Dashboard markdown

Carried by container images the latest versions of 3 of 17,781 indexed charts deploy, on 2 images.

Affected package	Affected versions	Fixed in	Images
apache-supersetpypi	0.0.0.dev0, 0.35.2	0.38.1	2

OSV records: GHSA-w358-rj93-r5qv
Also known as: BIT-superset-2021-27907, PYSEC-2021-127

Charts affected

3 by stars

Chart

Latest

Affected images

Radar Score

supersetcloudposse

1 of 1 See more

superset cloudposse 1.2.0

1 of the 1 container images this version deploys carry CVE-2021-27907.

Container image	Digest	Package	Fixed in
amancevice/superset :0.35.2	12a0a9e66550	apache-superset@0.35.2	0.38.1

Open the chart page →

5,851

fadicetic

1 of 25 See more

fadi cetic 0.3.1

1 of the 25 container images this version deploys carry CVE-2021-27907.

Container image	Digest	Package	Fixed in
amancevice/superset :0.35.2	12a0a9e66550	apache-superset@0.35.2	0.38.1

Open the chart page →

52,919

supersetinseefrlab

1 of 4 See more

superset inseefrlab 1.4.0

1 of the 4 container images this version deploys carry CVE-2021-27907.

Container image	Digest	Package	Fixed in
apache/superset :9cdaa280429ec297db16d56c94fd77b5d2aff107	975ab033580d	apache-superset@0.0.0.dev0	0.38.1

Open the chart page →

7,129

Container images carrying it

2 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
amancevice/superset :0.35.2	12a0a9e66550	apache-superset@0.35.2	0.38.1	2
apache/superset :9cdaa280429ec297db16d56c94fd77b5d2aff107	975ab033580d	apache-superset@0.0.0.dev0	0.38.1	1