SQL Injection

Overview apache-airflow-providers-mysql is a provider for Apache Airflow Affected versions of this package are vulnerable to SQL Injection through the dumpsql or loadsql functions. A user can inject DML into a table parameter from the UI on a DAG that uses one of these functions. Remediation...

CVE-2025-27018

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Airflow MySQL Provider. When user triggered a DAG with dumpsql or loadsql functions they could pass a table parameter from a UI, that could cause SQL injection by running SQL that was not...

CVE-2025-27018: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Airflow MySQL Provider. When user triggered a DAG with dumpsql or loadsql functions they could pass a table parameter from a UI, that could cause SQL injection by running SQL that was not...