Apache Airflow vulnerable to stored Cross-site Scripting

MEDIO 5.4CVE-2023-29247 · BIT-airflow-2023-29247 · GHSA-vcf6-3wv2-5vcr · Published 08/05/2023 · updated 17/06/2026

En resumen

CVE-2023-29247 es una vulnerabilidad MEDIO (CVSS 5.4) que afecta a apache-airflow, airflow (apache).
Probabilidad de explotación en los próximos 30 días (EPSS): 2.0%, mayor que el 80.6% de las vulnerabilidades.
Solución: actualizar a 2.6.0 o posterior.

Package	Affected versions	Patched versions
apache-airflow PyPI	`< 2.6.0`	`2.6.0`
airflow apache	`< 2.6.0`	`2.6.0`

Task instance details page in the UI is vulnerable to stored cross-site scripting. This issue affects Apache Airflow before 2.6.0.

NVD description

Task instance details page in the UI is vulnerable to a stored XSS.This issue affects Apache Airflow: before 2.6.0.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

PyPI

< 2.6.0

2.6.0

< 2.6.0

2.6.0

Más vulnerabilidades de apache-airflow

Ver todo →