CVE-2022-39359: Metabase's GeoJSON validation doesn't prevent redirects to blocked URLs

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-10-26 · updated 2026-06-17
Weakness: CWE-200

Description

Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, custom GeoJSON map URL address would follow redirects to addresses that were otherwise disallowed, like link-local or private-network. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9. Metabase no longer follow redirects on GeoJSON map URLs. An environment variable `MB_CUSTOM_GEOJSON_ENABLED` was also added to disable custom GeoJSON completely (`true` by default).

Affected products

metabase: from 0.41.0 before 0.41.9; from 0.42.0 before 0.42.6; from 0.43.0 before 0.43.7; from 0.44.0 before 0.44.5; from 1.41.0 before 1.41.9; from 1.42.0 before 1.42.6 — fixed in 0.41.9, 0.42.6, 0.43.7, 0.44.5, 1.41.9, 1.42.6

How to fix

Upgrade to a fixed version: metabase 0.41.9, 0.42.6, 0.43.7, 0.44.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-39359 or the next vulnerability affects your stack