VULNERABILITY INTELLIGENCE

CVE-2018-8021

CVSS score9.8 CRITICAL

EPSS probability53.41%

CISA KEVNot currently listed

Published2018-11-07

Last modified2026-06-17

CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to possible remote code execution. Note Superset 0.23 was released prior to any Superset release under the Apache Software Foundation.

Weakness classification

CWE-502: Deserialization of Untrusted Data

Primary references

security@apache.org — Patch, Third Party Advisory
security@apache.org — Exploit, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory, VDB Entry