CVE-2025-55672

Affected versions of the apache‑superset package are vulnerable to Cross‑site Scripting (XSS) due to improper sanitization of chart label inputs. The chart visualization module allows an authenticated user with edit‑chart permissions to inject a malicious payload into a chart’s column label, which is not properly sanitized and executes when the victim hovers over the chart. An attacker with such access can exploit this by crafting a chart label containing script code, triggering execution in other users’ browsers upon hover and potentially leading to session hijacking or arbitrary command execution on behalf of the user.