OS Command injection in Apache Airflow

HOCH 8.8CVE-2022-24288 · BIT-airflow-2022-24288 · GHSA-3v7g-4pg3-7r6j · Published 25/02/2022 · updated 17/06/2026

Kurz gesagt

CVE-2022-24288 ist eine Schwachstelle (HOCH (CVSS 8.8)) in apache-airflow, airflow (apache).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 77.9%, höher als bei 99.6% aller Schwachstellen.
Abhilfe: auf 2.2.4 oder neuer aktualisieren.

Package	Affected versions	Patched versions
apache-airflow PyPI	`< 2.2.4`	`2.2.4`
airflow apache	`< 2.2.4`	`2.2.4`

Description

In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection from the web UI.

NVD description

In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection from the web UI.

References

nvd.nist.gov/vuln/detail/CVE-2022-24288 · ADVISORY
GitHub Advisory GHSA-3v7g-4pg3-7r6j · ADVISORY
apache/airflow · PACKAGE
pypa/advisory-database · WEB
lists.apache.org/thread/dbw5ozcmr0h0lhs0yjph7xdc64oht23t · WEB

Weitere Schwachstellen in apache-airflow

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

apache-airflow

PyPI

< 2.2.4

2.2.4

airflow

apache

< 2.2.4

2.2.4

Description

In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection from the web UI.

NVD description

In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection from the web UI.

Weitere Schwachstellen in apache-airflow

Alle anzeigen →