Security vulnerabilities and automated fixes for apache superset issues
1 post found
Apache Superset's Cypress testing infrastructure depended on `brace-expansion` 5.0.7, a Node.js package vulnerable to denial of service via malformed brace pattern input (CVE-2026-14257). Upgrading to version 5.0.8 in `superset-frontend/cypress-base/package-lock.json` closes the vulnerability. While the affected file is part of the test toolchain, it lives in the production codebase and is flagged by Trivy as likely exploitable.