Medium
Security advisory
Apache Superset up to and including 1.0.1 allowed for the creation of an external URL that could be malicious. By not checking user input for open redirects the URL shortener functionality would allow for a malicious user to create a short URL for a dashboard that could convince the user to click the link.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2021-28125
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 04:32 UTC · Revision 1
Source evidence
Apache Superset up to and including 1.0.1 allowed for the creation of an external URL that could be malicious. By not checking user input for open redirects the URL shortener functionality would allow for a malicious user to create a short URL for a dashboard that could convince the user to click the link.
osv:CVE-2021-28125
Complete source record
{
"id": "100bd5a086a6594e7b5092b2134239b1410aba17744a38dd299d607abc05cd4e",
"url": "https://osv.dev/vulnerability/CVE-2021-28125",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2021-28125",
"summary": "Apache Superset up to and including 1.0.1 allowed for the creation of an external URL that could be malicious. By not checking user input for open redirects the URL shortener functionality would allow for a malicious user to create a short URL for a dashboard that could convince the user to click the link.",
"evidence": "osv:CVE-2021-28125",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2021-28125",
"aliases": [
"BIT-superset-2021-28125",
"CVE-2021-28125",
"GHSA-pfwg-rxf4-97c3",
"PYSEC-2021-128",
"PYSEC-2026-3078"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/apache/superset",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "c9a755f2536f23fcba95fd16c264079205f1a951"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "1.0.1"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"1.0.1rc2",
"1.0.1",
"1.0.1rc1",
"1.0.0rc4",
"1.0.0",
"1.0.0rc3",
"1.0.0rc2",
"1.0.0rc1",
"2020.51.1",
"v2020.51.0",
"test_tag",
"0.29.0rc1",
"0.25-fork",
"0.20.1",
"0.19.1",
"0.18.5",
"0.18.4",
"0.18.3",
"0.18.2",
"0.17.6",
"0.17.5",
"0.17.4",
"0.17.3",
"0.17.2",
"0.17.1",
"airbnb_prod.0.15.5.0",
"0.17.0",
"0.16.1",
"0.16.0",
"airbnb_prod.0.15.4.2",
"airbnb_prod.0.15.4.1",
"0.15.4.1",
"0.15.4",
"0.15.3",
"0.15.1",
"airbnb_prod.0.15.0.1",
"0.15.0",
"airbnb_prod.0.13.0.3",
"airbnb_prod.0.13.0.2",
"airbnb_prod.0.13.0.1",
"0.14.1",
"airbnb_prod.0.13.0.0",
"airbnb_prod.0.12.1.0",
"airbnb_prod.0.12.0.1",
"0.13.2",
"0.13.1",
"0.12.0",
"airbnb_prod.0.11.0.6",
"airbnb_prod.0.11.0.5",
"airbnb_prod.0.11.0.4",
"airbnb_prod.0.11.0.3",
"dummy",
"airbnb_prod.0.11.0.2",
"airbnb_prod.0.11.0.1",
"0.11.0",
"airbnb_prod.0.10.0.2",
"0.10.0",
"0.9.1",
"0.9.0",
"0.8.9",
"0.8.8",
"0.8.7",
"0.8.6",
"0.8.5",
"0.8.4",
"0.8.3",
"0.8.0",
"0.7.0",
"0.6.1",
"0.6.0",
"0.5.3",
"0.5.2",
"0.5.1",
"rm",
"0.5.0",
"0.4.0",
"0.2.1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-28125.json"
}
}
],
"modified": "2026-10-24T10:30:19.658185906Z",
"provider": "osv",
"references": [
"https://lists.apache.org/thread.html/r89b5d0dd35c1adc9624b48d6247729c73b2641b32754226661368434%40%3Cdev.superset.apache.org%3E"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2021-28125",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 430075,
"published_at": "2021-04-27T10:15:09.693+00:00"
}