6 matches found
GHSA-Q2HG-643C-GW8H Apache Airflow: RCE by race condition in example_xcom dag
The example examplexcom that was included in airflow documentation implemented unsafe pattern of reading value from xcom in the way that could be exploited to allow UI user who had access to modify XComs to perform arbitrary execution of code on the worker. Since the UI users are already highly...
Arbitrary Code Injection
Overview Affected versions of this package are vulnerable to Arbitrary Code Injection in the example code in examplexcom. Unsafe pattern of reading value from xcom could be exploited to allow UI user who had access to modify XComs to perform arbitrary execution of code on the worker. Note: Vendor...
CVE-2025-54550
The example examplexcom that was included in airflow documentation implemented unsafe pattern of reading value from xcom in the way that could be exploited to allow UI user who had access to modify XComs to perform arbitrary execution of code on the worker. Since the UI users are already highly...
CVE-2025-54550 Apache Airflow: RCE by race condition in example_xcom dag
The example examplexcom that was included in airflow documentation implemented unsafe pattern of reading value from xcom in the way that could be exploited to allow UI user who had access to modify XComs to perform arbitrary execution of code on the worker. Since the UI users are already highly...
CVE-2025-54550
CVE-2025-54550 concerns the example_xcom DAG in Apache Airflow docs, where an unsafe pattern for reading XCom values could enable arbitrarily code execution on the worker if a UI user who can modify XComs exploited it. The issue is limited to documentation examples and not a production Airflow re...
Command Injection in example_xcom.py via XCom race condition
This report is not public...