Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.4
Apache Superset could be tricked via Pillow image handling
published today
Summary
Apache Superset includes the Pillow image library, which has a coding error that could let a specially crafted image cause the application to run unintended code or crash. This could expose your data or interrupt service. Upgrade Superset (and its Pillow dependency) to the latest patched release and apply any vendor recommended updates.
What to do
- Update cleanstart apache-superset to version 2021.36.5-r0.
- Update cleanstart apache-superset to version 2021.38.2-r0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | apache-superset |
< 2021.36.5-r0 < 2021.38.2-r0 Fix: upgrade to 2021.36.5-r0
|
Original advisory text
Pillow is a Python imaging library
Security vulnerability affects the apache-superset package. Pillow is a Python imaging library.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Timeline
Published5 Nov 2026
Updated5 Nov 2026
First seen5 Nov 2026
Sources
CLEANSTART-2026-EI10751 · OSV
Track software like this
Free during beta