title: SQL injection vulnerability in chart data API
description: Apache Superset before 1.4.2 is vulnerable to SQL injection in chart data requests. Users should update to 1.4.2 or higher which addresses this issue.
problem types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
affected:
{
product: Apache Superset
vendor: Apache Software Foundation
versions:
lessThan: 1.4.2, status: affected, version: unspecified, versionType: custom
}