Remote Code Execution (RCE)

apache_superset is vulnerable to remote code execution (RCE). Failure to validate a number of templated text fields allows an authenticated user to send malicious requests and gain access to Pythons os package in the web application process and access files, environment variables and process information. Setting of environment variables for the current process, creating and updating files in folders writable by the web process and executing arbitrary programs accessible by the web process are also possible.