CVE-2018-8021 in the critical feed json
Deserialization of Untrusted Data in superset
published 2018-11-07 8 y ago modified 2026-06-17 4 mo ago also GHSA-vxp9-wv2f-wqmw , PYSEC-2018-74 , EUVD-2018-0137
- cvss
- 9.8
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 53.4%
- EPSS 53.4% chance of exploitation in 30 days, percentile 98%
- public exploits
- 1
- Exploit-DB
Summary
Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to possible remote code execution. Note Superset 0.23 was released prior to any Superset release under the Apache Software Foundation.
Patch / fix
- pypi superset 0.23, 0.23.0
- apache superset 0.23
- github.com/apache/superset@2c72a7a commit
- github.com/apache/incubator-superset#4243 pull request
- github.com/apache/superset#4243 pull request
Timeline
- Published
- First public exploit (EDB-45933)
Exploit prediction
53.41% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-45933 Apache Superset < 0.23 - Remote Code Execution webapps, 2018-12-03
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| GitHub | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | superset | <0.23 <0.23.0 |
0.23 0.23.0 |
Affected products
- unspecified Superset
Classification
- Weakness
-
- CWE-502 Deserialization of Untrusted Data
References
-
github.com
/apache/incubator-superset/pull/4243
web, patch, third-party-advisory
-
github.com
/apache/superset/pull/4243
web
-
github.com
/apache/superset/commit/2c72a7ae4fc0a8bac1f037a79efa90e1c5549710
web
-
exploit-db.com
/exploits/45933/
exploit, third-party-advisory, vdb-entry, web
-
nvd.nist.gov
/vuln/detail/CVE-2018-8021
advisory
-
github.com
/advisories/GHSA-vxp9-wv2f-wqmw
advisory
-
github.com
/apache/superset
package
-
github.com
/pypa/advisory-database/tree/main/vulns/superset/PYSEC-2018-74.yaml
web
-
exploit-db.com
/exploits/45933
web
Sources
- CVE List CVE-2018-8021
- GitHub Advisory GHSA-vxp9-wv2f-wqmw
- NVD CVE-2018-8021
- OSV PYSEC-2018-74
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.