Apache Airflow vulnerable to OS Command Injection via example DAGs

HIGH 8.8CVE-2022-40127 · BIT-airflow-2022-40127 · GHSA-6pw3-8h9w-32gc · Published 14/11/2022 · updated 17/06/2026

Package	Affected versions	Patched versions
apache-airflow PyPI	`< 2.4.0`	`2.4.0`
airflow apache	`< 2.4.0`	`2.4.0`

Description

A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided run_id parameter. This issue affects Apache Airflow versions prior to 2.4.0.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2022-40127 · ADVISORY
apache/airflow#25960 · WEB
apache/airflow commit 372e699 · WEB
apache/airflow · PACKAGE
pypa/advisory-database · WEB
lists.apache.org/thread/cf132hgm6jvzvsbpsozl3plf1r4cwysy · WEB
openwall.com/lists/oss-security/2022/11/14/2 · WEB
GitHub Advisory GHSA-6pw3-8h9w-32gc · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free