Link Injection

Apache Airflow is vulnerable to Link Injection. The vulnerability is due to improper validation for urls in the provider list within the file views.py, which allows an authenticated attacker to inject a malicious link when installing a provider...

Arbitrary Code Execution

Apache Airflow is vulnerable to Arbitrary Code Execution. The vulnerability is due to a flaw in the docmd parameter via airflow/models/dag.py, allowing authenticated DAG authors to craft it in a way that could execute arbitrary code in the scheduler context...

abi-ds-utils (=1.0.1), acryl-datahub-airflow-plugin (>=0.10.5.2rc3 <=0.11.0rc1) +29 more potentially affected by CVE-2024-39877 via apache-airflow (>=2.4.0 <=2.9.1)

apache-airflow PYPI version =2.4.0, =0.10.5.2rc3, =0.2.1, =0.9.0, =0.3.1, =0.0.4, =0.0.1a0, =1.0.0rc1, =1.0.0rc1, =1.0.0, =2.5.1rc1 - armada-airflow =0.5.4 - askquinta =0.1.1 and more Source cves: CVE-2024-39877 Source advisory: OSV:GHSA-G5HV-R743-V8PM...

Apache Airflow has DAG Author Code Execution possibility in airflow-scheduler

Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a docmd parameter in a way that could execute arbitrary code in the scheduler context, which should be forbidden according to the Airflow Security model. Users should upgrade to...

GHSA-G5HV-R743-V8PM Apache Airflow has DAG Author Code Execution possibility in airflow-scheduler

Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a docmd parameter in a way that could execute arbitrary code in the scheduler context, which should be forbidden according to the Airflow Security model. Users should upgrade to...

abi-ds-utils (=1.0.1), acceldata-o2a (=1.0.0) +146 more potentially affected by CVE-2024-39863 via apache-airflow (>=1.8.2 <=2.9.1)

apache-airflow PYPI version =1.8.2, =0.8.44.4, =1.4.0.3.post4, =1.4.0.3.post3, =0.1.0rc3, =0.1.0, =0.2.1, =0.2.9b1, =0.4.0, =0.1.0a1, =0.6.0, =0.1.1, =0.6.0 and more Source cves: CVE-2024-39863 Source advisory: OSV:GHSA-J482-47XF-P25C...

abi-ds-utils (=1.0.1), acryl-datahub-airflow-plugin (>=0.10.5.2rc3 <=0.11.0rc1) +29 more potentially affected by CVE-2024-39877 via apache-airflow (>=2.4.0 <=2.9.1)

apache-airflow PYPI version =2.4.0, =0.10.5.2rc3, =0.2.1, =0.9.0, =0.3.1, =0.0.4, =0.0.1a0, =1.0.0rc1, =1.0.0rc1, =1.0.0, =2.5.1rc1 - armada-airflow =0.5.4 - askquinta =0.1.1 and more Source cves: CVE-2024-39877 Source advisory: OSV:PYSEC-2024-190...

PYSEC-2024-190

Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a docmd parameter in a way that could execute arbitrary code in the scheduler context, which should be forbidden according to the Airflow Security model. Users should upgrade to...

PYSEC-2024-190

Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a docmd parameter in a way that could execute arbitrary code in the scheduler context, which should be forbidden according to the Airflow Security model. Users should upgrade to...

CVE-2024-39877

Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a docmd parameter in a way that could execute arbitrary code in the scheduler context, which should be forbidden according to the Airflow Security model. Users should upgrade to...

PYSEC-2024-189

Apache Airflow versions before 2.9.3 have a vulnerability that allows an authenticated attacker to inject a malicious link when installing a provider. Users are recommended to upgrade to version 2.9.3, which fixes this issue...

CVE-2024-39863

Apache Airflow versions before 2.9.3 have a vulnerability that allows an authenticated attacker to inject a malicious link when installing a provider. Users are recommended to upgrade to version 2.9.3, which fixes this issue...

PYSEC-2024-189

Apache Airflow versions before 2.9.3 have a vulnerability that allows an authenticated attacker to inject a malicious link when installing a provider. Users are recommended to upgrade to version 2.9.3, which fixes this issue...

CVE-2024-39877

Summary: CVE-2024-39877 affects Apache Airflow 2.4.0 and all versions before 2.9.3. Affected component is the doc_md parameter that authenticated DAG authors can craft to cause arbitrary code execution in the scheduler context. This is described across multiple sources (NVD, OSV entries, GHSA adv...

CVE-2024-39877 Apache Airflow: DAG Author Code Execution possibility in airflow-scheduler

Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a docmd parameter in a way that could execute arbitrary code in the scheduler context, which should be forbidden according to the Airflow Security model. Users should upgrade to...

CVE-2024-39877 Apache Airflow: DAG Author Code Execution possibility in airflow-scheduler

Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a docmd parameter in a way that could execute arbitrary code in the scheduler context, which should be forbidden according to the Airflow Security model. Users should upgrade to...

CVE-2024-39877 Apache Airflow: DAG Author Code Execution possibility in airflow-scheduler

Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a docmd parameter in a way that could execute arbitrary code in the scheduler context, which should be forbidden according to the Airflow Security model. Users should upgrade to...

CVE-2024-39863 Apache Airflow: Potential XSS Vulnerability

Apache Airflow versions before 2.9.3 have a vulnerability that allows an authenticated attacker to inject a malicious link when installing a provider. Users are recommended to upgrade to version 2.9.3, which fixes this issue...

CVE-2024-39863

CVE-2024-39863 affects Apache Airflow up to version 2.9.3 prior to the fix. An authenticated attacker can inject a malicious link during provider installation. Users should upgrade to Airflow 2.9.3 to remediate. Other connected sources corroborate the vulnerability in the same version range and d...

CVE-2024-39863 Apache Airflow: Potential XSS Vulnerability

Apache Airflow versions before 2.9.3 have a vulnerability that allows an authenticated attacker to inject a malicious link when installing a provider. Users are recommended to upgrade to version 2.9.3, which fixes this issue...