Apache Superset up to and including 1.1 does not sanitize titles correctly on the Explore page. This allows an attacker with Explore access to save a chart with a malicious title, injecting html (including scripts) into the page.
{ "github_reviewed_at": "2022-06-21T20:13:13Z", "severity": "MODERATE", "cwe_ids": [ "CWE-79" ], "github_reviewed": true, "nvd_published_at": "2021-10-18T15:15:00Z" }