title: Apache Superset: Improper rendering of user input
description: An authenticated attacker with write CSS template permissions can create a record with specific HTML tags that will not get properly escaped by the toast message displayed when a user deletes that specific CSS template record. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.
problem types: CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
affected:
{
defaultStatus: unaffected
product: Apache Superset
vendor: Apache Software Foundation
versions:
lessThan: 2.0.1, status: affected, version: 2.0.0, versionType: semver
lessThanOrEqual: 1.5.2, status: affected, version: 0, versionType: semver
}
metrics:
other: [
content: {'text': 'low'}
type: Textual description of severity
]