Apache Superset versions before 5.0.0 contain a stored Cross-Site Scripting (XSS) vulnerability in the chart visualization feature. Authenticated users with chart editing permissions can inject malicious scripts into column labels, which execute in other users' browsers when they hover over the chart. This can lead to session hijacking or arbitrary command execution. The issue is fixed in version 5.0.0.