MAL-2025-23512 Malicious code in iwasm-ion-schema (npm)

The package iwasm-ion-schema was found to contain malicious code...

MAL-2025-39624 Malicious code in xenobiology-darkmatter-schema-cosmicsilence (npm)

The package xenobiology-darkmatter-schema-cosmicsilence was found to contain malicious code...

MAL-2025-40446 Malicious code in yelp-schema-design (npm)

The package yelp-schema-design was found to contain malicious code...

MAL-2025-28665 Malicious code in paleobotany-planetology-schema-xo (npm)

The package paleobotany-planetology-schema-xo was found to contain malicious code...

MAL-2025-15702 Malicious code in biomimicry-cluster-geckodriver-schema (npm)

The package biomimicry-cluster-geckodriver-schema was found to contain malicious code...

MAL-2025-16175 Malicious code in brinkbit-schema-permissions (npm)

The package brinkbit-schema-permissions was found to contain malicious code...

MAL-2025-16176 Malicious code in brinkbit-schema-playerdata (npm)

The package brinkbit-schema-playerdata was found to contain malicious code...

MAL-2025-16177 Malicious code in brinkbit-schema-project (npm)

The package brinkbit-schema-project was found to contain malicious code...

MAL-2025-16178 Malicious code in brinkbit-schema-user (npm)

The package brinkbit-schema-user was found to contain malicious code...

MAL-2025-16174 Malicious code in brinkbit-schema-group (npm)

The package brinkbit-schema-group was found to contain malicious code...

Malicious code in nf-cl-schema-ui (npm)

The package nf-cl-schema-ui was found to contain malicious code...

Malicious code in mechatronics-vega-schema-castor (npm)

The package mechatronics-vega-schema-castor was found to contain malicious code...

Malicious code in brinkbit-schema-project (npm)

The package brinkbit-schema-project was found to contain malicious code...

Apache Superset data query improperly discloses database schema information to low-privileged guest user

When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user. Thi...

GHSA-9G5X-MM39-WG9R Apache Superset data query improperly discloses database schema information to low-privileged guest user

When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user. Thi...

Exposure of Sensitive System Information to an Unauthorized Control Sphere

Overview apache-superset is a modern, enterprise-ready business intelligence web application. Affected versions of this package are vulnerable to Exposure of Sensitive System Information to an Unauthorized Control Sphere via the query field in the API response from the /chart/data endpoint. An...

CVE-2025-55673

When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user. Thi...

CVE-2025-55673 Apache Superset: Metadata exposure in embedded charts

When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user. Thi...

CVE-2025-55673 Apache Superset: Metadata exposure in embedded charts

When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user. Thi...

CVE-2025-55673

Apache Superset contains an information disclosure in the /chart/data response: when a guest user accesses a chart, the payload includes the underlying query, exposing database schema details (e.g., table names). This affects versions before 4.1.3. The issue is mitigated by upgrading to version 4...