Loading HuntDB...

GHSA-g5hv-r743-v8pm

GitHub Security Advisory

Apache Airflow has DAG Author Code Execution possibility in airflow-scheduler

✓ GitHub Reviewed HIGH Has CVE

Advisory Details

Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a doc_md parameter in a way that could execute arbitrary code in the scheduler context, which should be forbidden according to the Airflow Security model. Users should upgrade to version 2.9.3 or later which has removed the vulnerability.

Affected Packages

PyPI apache-airflow
Affected versions: 2.4.0 (fixed in 2.9.3)

Related CVEs

Key Information

GHSA ID
GHSA-g5hv-r743-v8pm
Published
July 17, 2024 9:30 AM
Last Modified
January 21, 2025 5:58 PM
CVSS Score
7.5 /10
Primary Ecosystem
PyPI
Primary Package
apache-airflow
GitHub Reviewed
✓ Yes

Dataset

Last updated: November 24, 2025 6:29 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.