title: XSS vulnerability on Explore page
description: Apache Superset up to and including 1.1 does not sanitize titles correctly on the Explore page. This allows an attacker with Explore access to save a chart with a malicious title, injecting html (including scripts) into the page.
problem types: CWE-79 Cross-site Scripting (XSS)
affected:
{
product: Apache Superset
vendor: Apache Software Foundation
versions:
lessThanOrEqual: 1.1, status: affected, version: unspecified, versionType: custom
}