{"action":"Upgrade apache-superset to 0.37.1 or later.","affected":[{"fixed":"0.37.1","introduced":"0"}],"component":"apache-superset","cve_ids":["CVE-2020-13948"],"ecosystem":"PyPI","epss":0.03102,"exploited":false,"fixed_versions":["0.37.1"],"ghsa_id":"GHSA-cj7g-h7rf-h8j9","id":"tcs_01M5KG9W8FXWZ7G9YAG389J7KB","modified_at":"2026-06-10T17:00:33.061126448Z","published_at":"2020-09-17T13:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2020-222","https://lists.apache.org/thread.html/rdeee068ac1e0c43bd5b69830240f30598df15a2ef9f7998c7b29131e%40%3Cdev.superset.apache.org%3E","https://lists.apache.org/thread.html/r0e35c7c5672a6146b962840be5c1a7b7461c05a71cd7ecc62774d155@%3Cnotifications.superset.apache.org%3E","https://lists.apache.org/thread.html/r4fc7115f6e63ac255c48fc68c0da592df55fe4be47cae6378d39ac22@%3Cnotifications.superset.apache.org%3E","https://github.com/advisories/GHSA-cj7g-h7rf-h8j9"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2020-222","url":"https://osv.dev/vulnerability/PYSEC-2020-222"}],"summary":"While investigating a bug report on Apache Superset, it was determined that an authenticated user could craft requests via a number of templated text fields in the product that would allow arbitrary a"}