OS Command injection in Apache Airflow

HIGH 8.8CVE-2022-24288 · BIT-airflow-2022-24288 · GHSA-3v7g-4pg3-7r6j · Published 25/02/2022 · updated 17/06/2026

Package	Affected versions	Patched versions
apache-airflow PyPI	`< 2.2.4`	`2.2.4`
airflow apache	`< 2.2.4`	`2.2.4`

Description

In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection from the web UI.

NVD description

In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection from the web UI.

References

nvd.nist.gov/vuln/detail/CVE-2022-24288 · ADVISORY
GitHub Advisory GHSA-3v7g-4pg3-7r6j · ADVISORY
apache/airflow · PACKAGE
pypa/advisory-database · WEB
lists.apache.org/thread/dbw5ozcmr0h0lhs0yjph7xdc64oht23t · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free