{"action":"Upgrade apache-superset to 1.1.0 or later.","affected":[{"fixed":"1.1.0","introduced":"0"}],"component":"apache-superset","cve_ids":["CVE-2021-28125"],"ecosystem":"PyPI","epss":0.64016,"exploited":false,"fixed_versions":["1.1.0"],"ghsa_id":"GHSA-pfwg-rxf4-97c3","id":"tcs_01M5KGB6612ETB11V4B5Y0NJ9B","modified_at":"2026-07-13T16:43:32.420251064Z","published_at":"2021-04-27T10:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2021-128","https://lists.apache.org/thread.html/r89b5d0dd35c1adc9624b48d6247729c73b2641b32754226661368434%40%3Cdev.superset.apache.org%3E","https://lists.apache.org/thread.html/r89b5d0dd35c1adc9624b48d6247729c73b2641b32754226661368434@%3Cdev.superset.apache.org%3E","http://www.openwall.com/lists/oss-security/2021/04/27/2","https://github.com/advisories/GHSA-pfwg-rxf4-97c3"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2021-128","url":"https://osv.dev/vulnerability/PYSEC-2021-128"}],"summary":"Apache Superset up to and including 1.0.1 allowed for the creation of an external URL that could be malicious. By not checking user input for open redirects the URL shortener functionality would allow"}