Likely permanent: GitHub doesn’t review this ecosystem

GHSA-vmm4-cwrm-38rj

Metabase OSS and Enterprise on metabase · published in metabase/metabase

Fixed in 0.41.4, 1.41.4, 0.40.7, 1.40.7, 0.39.7, 1.39.7, 0.38.6, 1.38.6. Dependabot, npm audit and OSV-Scanner probably never will. Find it in your project

Facts

Severity: Critical
Affected versions: <x.41.4, <x.40.7,<x.39.7,<x.38.6,<0.37As entered by the maintainer. Not reviewed. Scanners can’t read this range. How to fix it
Fixed in: 0.41.4,1.41.4,0.40.7,1.40.7,0.39.7,1.39.7,0.38.6,1.38.6
CVE: None cited by the advisory
GitHub Advisory Database: Not reviewed
OSV.dev: Not present
Other CVEs pointing here: None found in the CVE List

If you use Metabase OSS and Enterprise <x.41.4, <x.40.7,<x.39.7,<x.38.6,<0.37

Upgrade to the fixed version for your release line: 0.41.4, 1.41.4, 0.40.7, 1.40.7, 0.39.7, 1.39.7, 0.38.6, 1.38.6. Dependabot, npm audit and OSV-Scanner probably never will.

Timeline

2021-12-12 17:11 UTC
Published by the maintainers
No CVE cited
2026-10-31 12:45 UTC
First seen by Limbowatch
not reviewed · not in OSV
Not expected
Reviewed by GitHub
GitHub doesn’t review this ecosystem

Machine-readable record: feed/GHSA-vmm4-cwrm-38rj.json