{"id":"CVE-2024-53947","aliases":["GHSA-92qf-8gh3-gwcm","BIT-superset-2024-53947","PYSEC-2026-1165"],"title":"Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions","summary":"Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","vendor":"apache-superset","product":"apache-superset","ecosystem":"pip","affected":["apache-superset < 4.1.0"],"patched":["apache-superset 4.1.0"],"published":"2024-12-09","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-92qf-8gh3-gwcm","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53947"},{"url":"https://github.com/apache/superset/commit/0e0028260fc8a2099250701524a489f3c9aa146f"},{"url":"https://github.com/apache/superset"},{"url":"https://lists.apache.org/thread/hj3gfsjh67vqw12nlrshlsym4bkopjmn"}],"tags":["osv","pip"],"epss":0.00836,"epssPercentile":0.55899,"ingestedAt":"2026-07-08T18:25:47.687Z","slug":"CVE-2024-53947","body":"## Overview\n\nImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Superset. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. This issue is a follow-up to CVE-2024-39887 with additional disallowed PostgreSQL functions now included: query_to_xml_and_xmlschema, table_to_xml, table_to_xml_and_xmlschema.\n\nThis issue affects Apache Superset: <4.1.0.\n\nUsers are recommended to upgrade to version 4.1.0, which fixes the issue or add these Postgres functions to the config set DISALLOWED_SQL_FUNCTIONS.\n\n## Affected packages\n\n- `apache-superset < 4.1.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `apache-superset 4.1.0`","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}