GitHub Advisoryadvisory · PyPI

GHSA-6pw3-8h9w-32gc Apache Airflow vulnerable to OS Command Injection via example DAGs

HIGH Published 2022-11-14 Modified 2025-05-01 Official page ↗
Aliases
CVE-2022-40127
Ecosystem
PyPI
Packages
apache-airflow
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78, CWE-94
Reviewed
2022-11-16

Affected packages

• PyPI apache-airflow: < 2.4.0 → fixed in 2.4.0

Description

A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided run_id parameter. This issue affects Apache Airflow versions prior to 2.4.0.

Related

Alias · CVE (1)

  • CVE-2022-40127 A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via… vulnerability

Weakness · CWE (2)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness
  • CWE-94 Improper Control of Generation of Code weakness

References