GHSA-h63r-9xxf-f2c7

GitHub Security Advisory

Apache Airflow Cross-site Scripting vulnerability

✓ GitHub Reviewed MODERATE Has CVE

In Apache Airflow versions prior to 2.4.2, the "Trigger DAG with config" screen was susceptible to XSS attacks via the `origin` query argument.

PyPI apache-airflow

Affected versions: 0 (fixed in 2.4.2rc1)

CVE-2022-43982

GHSA ID

GHSA-h63r-9xxf-f2c7

Published

November 2, 2022 7:00 PM

Last Modified

May 2, 2025 9:57 PM

CVSS Score

5.0 /10

Primary Ecosystem

PyPI

Primary Package

apache-airflow

GitHub Reviewed

✓ Yes

Last updated: November 23, 2025 6:29 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.