airflow-balancer (>=0.7.0 <=0.7.6), airflow-clickhouse-plug (=1.6.2) +37 more potentially affected by CVE-2026-34538 via apache-airflow (>=3.0.0 <=3.1.8rc2)

apache-airflow PYPI version =3.0.0, =0.7.0, =1.5.0, =0.6.1, =1.10.7, =0.6.0a1, =0.1.0, =1.4.3, =1.2.10, =0.1.1, =3.0.0, =1.6.0, =1.5.3, =1.25.0, =3.12.0, =3.12.0rc1 and more Source cves: CVE-2026-34538 Source advisory: OSV:PYSEC-2026-21...

acceldata-o2a (=1.0.0), aglow (>=0.1.0rc3 <=0.1.0rc4) +138 more potentially affected by CVE-2025-27555 via apache-airflow (>=1.10.1 <=2.11.0)

apache-airflow PYPI version =1.10.1, =0.1.0rc3, =0.1.0, =1.0.7, =0.5.1, =0.1.0, =0.1.1, =0.0.7, =2.4.2, =1.0.1, =0.0.1, =0.0.1, =0.1.6, =0.1.10 and more Source cves: CVE-2025-27555 Source advisory: OSV:GHSA-8R55-RV5W-6PFM...

acceldata-o2a (=1.0.0), aglow (>=0.1.0rc3 <=0.1.0rc4) +30 more potentially affected by CVE-2025-65995 via apache-airflow (>=2.0.0 <=2.11.0)

apache-airflow PYPI version =2.0.0, =0.1.0rc3, =0.1.0, =0.6.0, =0.0.1, =0.6.4, =1.0.0, =0.2.0, =2.10.3, =0.3.12, =1.8.0rc2, =4.3.0, =6.0.1 and more Source cves: CVE-2025-65995 Source advisory: SNYK:PYTHON-APACHEAIRFLOW-15325637...

airflow-aggua-plugin (>=1.0.7 <=1.0.8), airflow-clickhouse-plugin (>=0.5.6 <=0.5.7.post1) +95 more potentially affected by CVE-2024-32077 via apache-airflow (>=1.10.1 <=1.10.15)

apache-airflow PYPI version =1.10.1, =1.0.7, =0.5.6, =0.1.0, =0.0.7, =0.0.1, =0.1.6, =0.0.2, =1.0.0, =1.2.1, =2020.5.20rc1, =2021.2.5, =2020.5.20rc1, =2020.5.20rc1, =2020.5.20rc1, =2021.3.17rc1 and more Source cves: CVE-2024-32077 Source advisory: OSV:PYSEC-2024-264...

abi-ds-utils (=1.0.1), acceldata-o2a (=1.0.0) +231 more potentially affected by CVE-2023-22888 via apache-airflow (>=1.10.1 <=2.5.3)

apache-airflow PYPI version =1.10.1, =0.8.44.4, =1.4.0.3.post4, =1.4.0.3.post3, =0.1.0rc3, =0.1.0, =0.2.9b1, =1.0.7, =0.4.0, =0.1.0a1, =0.5.1, =0.1.1, =0.1.1, =1.10.6 and more Source cves: CVE-2023-22888 Source advisory: OSV:GHSA-5946-8P38-VFFP...

abi-ds-utils (=1.0.1), acceldata-o2a (=1.0.0) +231 more potentially affected by CVE-2023-25754 via apache-airflow (>=1.10.1 <=2.5.3)

apache-airflow PYPI version =1.10.1, =0.8.44.4, =1.4.0.3.post4, =1.4.0.3.post3, =0.1.0rc3, =0.1.0, =0.2.9b1, =1.0.7, =0.4.0, =0.1.0a1, =0.5.1, =0.1.1, =0.1.1, =1.10.6 and more Source cves: CVE-2023-25754 Source advisory: OSV:PYSEC-2023-59...

CVE-2022-41131 Apache Airflow Hive Provider vulnerability (command injection via hive_cli connection)

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Apache Airflow Hive Provider, Apache Airflow allows an attacker to execute arbtrary commands in the task execution context, without write access to DAG files. This issue affects Hive Provider...

CVE-2022-40954 Apache Airflow Spark Provider RCE that bypass restrictions to read arbitrary files

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Apache Airflow Spark Provider, Apache Airflow allows an attacker to read arbtrary files in the task execution context, without write access to DAG files. This issue affects Spark Provider...

CVE-2022-41131

The CVE-2022-41131 issue is an OS command injection in the Apache Airflow Hive Provider. Vulnerable components: Hive Provider versions prior to 4.1.0, and Airflow versions prior to 2.3.0 if the Hive Provider is installed. Root cause is improper neutralization of special elements in OS commands, a...

abi-ds-utils (=1.0.1), airflow-add-ons (=0.2.9b1) +4 more potentially affected by CVE-2022-40604 via apache-airflow (>=2.3.2 <=2.4.0)

apache-airflow PYPI version =2.3.2, =0.1.0, =0.1.0, =0.10.0.1 Source cves: CVE-2022-40604 Source advisory: OSV:PYSEC-2022-279...

airflow-util-dv (>=1.2.1 <=1.6.2), apache-liminal (>=0.0.1.post1 <=0.0.3rc4) +10 more potentially affected by CVE-2020-17526 via apache-airflow (>=1.10.1 <=1.10.13)

apache-airflow PYPI version =1.10.1, =1.2.1, =0.0.1.post1, =0.0.1, =0.50.1, =0.0.1, =0.0.6, =6.0.0, =0.1.0, =10.3.0rc1, =0.5.0a9, =0.6.0a15 Source cves: CVE-2020-17526 Source advisory: OSV:PYSEC-2020-22...

airflow-util-dv (>=1.2.1 <=1.6.2), apache-liminal (>=0.0.1.post1 <=0.0.3rc4) +8 more potentially affected by CVE-2020-17513 via apache-airflow (>=1.10.1 <=1.10.12)

apache-airflow PYPI version =1.10.1, =1.2.1, =0.0.1.post1, =0.0.1, =0.50.1, =0.0.1, =6.0.0, =0.1.0, =10.3.0rc1, =0.5.0a9, =0.6.0a15 Source cves: CVE-2020-17513 Source advisory: OSV:PYSEC-2020-20...