CVE-2020-26870

Advisory

Apache-superset 0.35.1 updates its dependency 'dompurify' to v2.0.7 to include a security fix.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

- [8457](https://github.com/apache/superset/pull/8457) [fix] Improve csv upload functionality (#8457) (villebro)
- [8566](https://github.com/apache/superset/pull/8566) [druid] Fix, pydruid forced dependency (#8566) (dpgaspar)
- [8558](https://github.com/apache/superset/pull/8558) bump legacy-preset-chart-nvd3 to 0.11.5 (#8558) (nytai)
- [8498](https://github.com/apache/superset/pull/8498) build: bump dompurify version because of nasty xss bypass. (#8498) (MarcusSorealheis)
- [8477](https://github.com/apache/superset/pull/8477) [cli] Fix, import datasources exported by UI (#8477) (dpgaspar)
- [8487](https://github.com/apache/superset/pull/8487) fixing typo. (#8487) (MarcusSorealheis)
- [8430](https://github.com/apache/superset/pull/8430) [pydruid] Bumping the pydruid version (#8430) (john-bodley)

Resources

• https://pypi.org/project/apache-superset
• https://pyup.io/changelogs/apache-superset/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26870