OS Command Injection in Apache Airflow
Critical9.8CVE-2022-38649 · Published Nov 22, 2022 · updated Jun 29, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| apache-airflow PyPI | < 2.3.0 | 2.3.0 |
Details and references
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Pinot Provider, Apache Airflow allows an attacker to control commands executed in the task execution context, without write access to DAG files. This issue affects Apache Airflow Pinot Provider versions prior to 4.0.0. It also impacts any Apache Airflow versions prior to 2.3.0 in case Apache Airflow Pinot Provider is installed (Apache Airflow Pinot Provider 4.0.0 can only be installed for Airflow 2.3.0+). Note that you need to manually install the Pinot Provider version 4.0.0 in order to get rid of the vulnerability on top of Airflow 2.3.0+ version.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-78
- Also known as
- BIT-airflow-2022-38649, CVE-2022-38649, PYSEC-2026-267
More Apache Airflow advisories
All Apache Airflow| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Nov 222022 | OS Command Injection in Apache Airflow CVE-2022-40954Medium5.5fixed in 2.3.0 | Medium5.5 | 2.3.0 |
| Nov 222022 | OS Command Injection in Apache Airflow CVE-2022-40189Critical9.8fixed in 2.3.0 | Critical9.8 | 2.3.0 |
| Nov 152022 | Apache Airflow Contains Open Redirect CVE-2022-45402Medium6.1fixed in 2.4.3 | Medium6.1 | 2.4.3 |
| Nov 142022 | Apache Airflow vulnerable to OS Command Injection via example DAGs CVE-2022-40127High8.8fixed in 2.4.0 | High8.8 | 2.4.0 |
| Nov 142022 | Apache Airflow subject to Exposure of Sensitive Information CVE-2022-27949High7.5fixed in 2.3.1 | High7.5 | 2.3.1 |
| Nov 22022 | Apache Airflow Cross-site Scripting vulnerability CVE-2022-43982Medium6.1fixed in 2.4.2rc1 | Medium6.1 | 2.4.2rc1 |