{"action":"Upgrade apache-superset to 0.38.1 or later.","affected":[{"fixed":"0.38.1","introduced":"0"}],"component":"apache-superset","cve_ids":["CVE-2021-27907"],"ecosystem":"PyPI","epss":0.86393,"exploited":false,"fixed_versions":["0.38.1"],"ghsa_id":"GHSA-w358-rj93-r5qv","id":"tcs_01M5KGB61EA5XN7BPDQEMVHRBP","modified_at":"2025-02-05T09:11:57.593021Z","published_at":"2021-03-05T12:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2021-127","https://lists.apache.org/thread.html/r09293fb09f1d617f0d2180c42210e739e2211f8da9bc5c1873bea67a%40%3Cdev.superset.apache.org%3E","https://lists.apache.org/thread.html/r09293fb09f1d617f0d2180c42210e739e2211f8da9bc5c1873bea67a@%3Cdev.superset.apache.org%3E","https://github.com/advisories/GHSA-w358-rj93-r5qv"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2021-127","url":"https://osv.dev/vulnerability/PYSEC-2021-127"}],"summary":"Apache Superset up to and including 0.38.0 allowed the creation of a Markdown component on a Dashboard page for describing chart's related information. Abusing this functionality, a malicious user cou"}