high8.8
CVE-2022-24288
OS Command injection in Apache Airflow
Impact
In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection from the web UI.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | apache-airflow | < 2.2.4 | 2.2.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Airflow | before 2.2.4 |