OS Command Injection in Apache Airflow
Medium5.5CVE-2022-40954 · Published Nov 22, 2022 · updated Jul 7, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| apache-airflow PyPI | < 2.3.0 | 2.3.0 |
Details and references
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Spark Provider, Apache Airflow allows an attacker to read arbtrary files in the task execution context, without write access to DAG files. This issue affects Spark Provider versions prior to 4.0.0. It also impacts any Apache Airflow versions prior to 2.3.0 in case Spark Provider is installed (Spark Provider 4.0.0 can only be installed for Airflow 2.3.0+). Note that you need to manually install the Spark Provider version 4.0.0 in order to get rid of the vulnerability on top of Airflow 2.3.0+ version that has lower version of the Spark Provider installed).
- CVSS 3.1
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-78
- Also known as
- BIT-airflow-2022-40954, CVE-2022-40954, PYSEC-2026-770
More Apache Airflow advisories
All Apache Airflow| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Nov 222022 | OS Command Injection in Apache Airflow CVE-2022-38649Critical9.8fixed in 2.3.0 | Critical9.8 | 2.3.0 |
| Nov 222022 | OS Command Injection in Apache Airflow CVE-2022-40189Critical9.8fixed in 2.3.0 | Critical9.8 | 2.3.0 |
| Nov 152022 | Apache Airflow Contains Open Redirect CVE-2022-45402Medium6.1fixed in 2.4.3 | Medium6.1 | 2.4.3 |
| Nov 142022 | Apache Airflow vulnerable to OS Command Injection via example DAGs CVE-2022-40127High8.8fixed in 2.4.0 | High8.8 | 2.4.0 |
| Nov 142022 | Apache Airflow subject to Exposure of Sensitive Information CVE-2022-27949High7.5fixed in 2.3.1 | High7.5 | 2.3.1 |
| Nov 22022 | Apache Airflow Cross-site Scripting vulnerability CVE-2022-43982Medium6.1fixed in 2.4.2rc1 | Medium6.1 | 2.4.2rc1 |