Apache AirflowGHSA-rmf2-pwfq-h75j
OS Command Injection in Apache Airflow
Critical9.8CVE-2022-40189 · Published Nov 22, 2022 · updated Jun 29, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| apache-airflow PyPI | < 2.3.0 | 2.3.0 |
Details and references
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Pig Provider, Apache Airflow allows an attacker to control commands executed in the task execution context, without write access to DAG files. This issue affects Pig Provider versions prior to 4.0.0. It also impacts any Apache Airflow versions prior to 2.3.0 in case Pig Provider is installed (Pig Provider 4.0.0 can only be installed for Airflow 2.3.0+). Note that you need to manually install the Pig Provider version 4.0.0 in order to get rid of the vulnerability on top of Airflow 2.3.0+ version.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-78
- Also known as
- BIT-airflow-2022-40189, CVE-2022-40189, PYSEC-2026-270
More Apache Airflow advisories
All Apache Airflow| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Nov 222022 | OS Command Injection in Apache Airflow CVE-2022-40954Medium5.5fixed in 2.3.0 | Medium5.5 | 2.3.0 |
| Nov 222022 | OS Command Injection in Apache Airflow CVE-2022-38649Critical9.8fixed in 2.3.0 | Critical9.8 | 2.3.0 |
| Nov 152022 | Apache Airflow Contains Open Redirect CVE-2022-45402Medium6.1fixed in 2.4.3 | Medium6.1 | 2.4.3 |
| Nov 142022 | Apache Airflow vulnerable to OS Command Injection via example DAGs CVE-2022-40127High8.8fixed in 2.4.0 | High8.8 | 2.4.0 |
| Nov 142022 | Apache Airflow subject to Exposure of Sensitive Information CVE-2022-27949High7.5fixed in 2.3.1 | High7.5 | 2.3.1 |
| Nov 22022 | Apache Airflow Cross-site Scripting vulnerability CVE-2022-43982Medium6.1fixed in 2.4.2rc1 | Medium6.1 | 2.4.2rc1 |