CVE-2022-24855: XSS vulnerability in Metabase

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-04-14 · updated 2026-06-17
Weakness: CWE-79

Description

Metabase is an open source business intelligence and analytics application. In affected versions Metabase ships with an internal development endpoint `/_internal` that can allow for cross site scripting (XSS) attacks, potentially leading to phishing attempts with malicious links that could lead to account takeover. Users are advised to either upgrade immediately, or block access in your firewall to `/_internal` endpoints for Metabase. The following patches (or greater versions) are available: 0.42.4 and 1.42.4, 0.41.7 and 1.41.7, 0.40.8 and 1.40.8.

Affected products

metabase: from 0.40.0 before 0.40.8; from 0.41.0 before 0.41.7; from 0.42.0 before 0.42.4; from 1.40.0 before 1.40.8; from 1.41.0 before 1.41.7; from 1.42.0 before 1.42.4 — fixed in 0.40.8, 0.41.7, 0.42.4, 1.40.8, 1.41.7, 1.42.4

How to fix

Upgrade to a fixed version: metabase 0.40.8, 0.41.7, 0.42.4, 1.40.8. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-24855 or the next vulnerability affects your stack