Metabase's GeoJSON validation doesn't prevent redirects to blocked URLs

6.5 CVSS

Vulnerability Description

Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, custom GeoJSON map URL address would follow redirects to addresses that were otherwise disallowed, like link-local or private-network. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9. Metabase no longer follow redirects on GeoJSON map URLs. An environment variable `MB_CUSTOM_GEOJSON_ENABLED` was also added to disable custom GeoJSON completely (`true` by default).

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-39359

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from metabase

View All →

CVE-2025-32382

Snowflake credentials logged by the Metabase backend

Low 1.8

CVE-2025-30371

Metabase vulnerable to circumvention of local link access protection in GeoJson endpoint

Low 2.1

CVE-2025-27141

Metabase Enterprise Edition allows cached questions to leak data to impersonated users

Medium 4.8

CVE-2024-55951

Metabase sandboxed users could see filter values from other sandboxed users

Medium 4.8

CVE-2023-37470

Metabase vulnerable to remote code execution via POST /api/setup/validate API endpoint

Critical 10

Affected Vendor

metabase

View all reports →

Affected Software

metabase

Vulnerable Versions:

< 0.41.9, >= 0.42.0, < 0.42.6, >= 0.43.0, < 0.43.7, >= 0.44.0, < 0.44.5, >= 1.0.0, < 1.41.9, >= 1.42.0, < 1.42.6, >= 1.43.0, < 1.43.7, >= 1.44.0, < 1.44.5