Apache AirflowGHSA-w7cp-g8v7-r54m
Apache Airflow Cross-site Scripting Vulnerability
Medium6.1CVE-2024-41937 · Published Aug 21, 2024 · updated Sep 10, 2026
Apache Airflow, versions before 2.10.0, have a vulnerability that allows the developer of a malicious provider to execute a cross-site scripting attack when clicking on a provider documentation link. This would require the provider to be installed on the web server and the user to click the provider link. Users should upgrade to 2.10.0 or later, which fixes this vulnerability.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| apache-airflow PyPI | < 2.10.0 | 2.10.0 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-79
- Also known as
- BIT-airflow-2024-41937, CVE-2024-41937, PYSEC-2024-181
- nvd.nist.gov/vuln/detail/CVE-2024-41937
- github.com/apache/airflow/pull/40933
- github.com/apache/airflow/commit/f1852c2ab28b155e196569780013fbb61a4a1f98
- github.com/apache/airflow
- github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2024-181.yaml
- lists.apache.org/thread/lwlmgg6hqfmkpvw5py4w53hxyl37jl6d
- www.openwall.com/lists/oss-security/2024/08/21/3
More Apache Airflow advisories
All Apache Airflow| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Sep 72024 | Apache Airflow vulnerable to Improper Encoding or Escaping of Output High8.8Sep 7, 2024 | High8.8 | 2.10.1 |
| Sep 72024 | Apache Airflow vulnerable to Execution with Unnecessary PrivilegesHigh8.8Sep 7, 2024 | High8.8 | 2.10.1 |
| Aug 52024 | Insufficient Session Expiration vulnerability in Apache Airflow Providers FABCritical9.8Aug 5, 2024 | Critical9.8 | No fix yet |
| Jul 172024 | Apache Airflow has DAG Author Code Execution possibility in airflow-schedulerHigh8.8Jul 17, 2024 | High8.8 | 2.9.3 |
| Jul 172024 | Apache Airflow Potential Cross-site Scripting VulnerabilityMedium5.4Jul 17, 2024 | Medium5.4 | 2.9.3 |
| Jun 142024 | Apache Airflow does not return the "Cache-Control" header for dynamic contentLowJun 14, 2024 | Low | 2.9.2 |