Likely permanent: GitHub doesn’t review this ecosystem

GHSA-wpjg-6c2f-pcg9

Metabase OSS and Metabase Enterprise on metabase · published in metabase/metabase

Fixed in 0.41.3.1, 1.41.3.1, 0.40.6, 1.40.6, 0.39.6, 1.39.6, 0.38.6, 1.38.6. Dependabot, npm audit and OSV-Scanner probably never will. Find it in your project

Facts

Severity: High
Affected versions: <x.41.3, <x.40.6, <x.39.6, <x.38.6As entered by the maintainer. Not reviewed. Scanners can’t read this range. How to fix it
Fixed in: 0.41.3.1,1.41.3.1,0.40.6,1.40.6,0.39.6,1.39.6,0.38.6,1.38.6
CVE: None cited by the advisory
GitHub Advisory Database: Not reviewed
OSV.dev: Not present
Other CVEs pointing here: None found in the CVE List

If you use Metabase OSS and Metabase Enterprise <x.41.3, <x.40.6, <x.39.6, <x.38.6

Upgrade to the fixed version for your release line: 0.41.3.1, 1.41.3.1, 0.40.6, 1.40.6, 0.39.6, 1.39.6, 0.38.6, 1.38.6. Dependabot, npm audit and OSV-Scanner probably never will.

Timeline

2021-12-12 17:14 UTC
Published by the maintainers
No CVE cited
2026-10-31 12:45 UTC
First seen by Limbowatch
not reviewed · not in OSV
Not expected
Reviewed by GitHub
GitHub doesn’t review this ecosystem

Machine-readable record: feed/GHSA-wpjg-6c2f-pcg9.json