CVE-2021-45229: Cross-Site Scripting in Apache Airflow
Summary
CVE-2021-45229: Apache Airflow Cross-site Scripting Vulnerability. Affects apache-airflow versions < 2.2.4rc1. Fixed in 2.2.4rc1. How to fix ↓
Also tracked for
- airflow · Bitnami
The same CVE-2021-45229 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Airflow is an open-source platform used for programmatically authoring, scheduling, and monitoring workflows. It provides a rich set of features for managing and executing data pipelines. However, versions 2.2.3 and below of Apache Airflow are susceptible to a cross-site scripting (XSS) vulnerability.
Vulnerability Detail
The vulnerability, identified as CVE-2021-45229, specifically affects the "Trigger DAG with config" screen in Apache Airflow. Attackers can exploit this vulnerability by injecting malicious code through the origin query argument. This allows them to execute arbitrary scripts within the context of the affected user's browser. The impact of this vulnerability can range from unauthorized data access to potential remote code execution.
How To Fix
Latest published version: 3.3.2 as of 22 Oct 2026
pip install --upgrade "apache-airflow==3.3.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.2.4rc1
This is the first release that contains the fix.
pip install --upgrade "apache-airflow==2.2.4rc1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable the affected functionality or implement input validation and sanitization measures on the server-side. This can help mitigate the risk of XSS attacks until a proper fix can be applied.
Conclusion
In conclusion, the CVE-2021-45229 vulnerability in Apache Airflow exposes users to potential cross-site scripting attacks. It is crucial to upgrade to the latest version of Apache Airflow (2.2.4 or later) to ensure the vulnerability is patched. If immediate upgrading is not feasible, implementing temporary workarounds and following best practices for input validation can help mitigate the risk. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apache-airflow →
FAQ
Apache Airflow is an open-source platform used for managing and executing data workflows. It provides a rich set of features for scheduling, monitoring, and orchestrating tasks.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to unauthorized data access, session hijacking, or other malicious activities.
The CVE-2021-45229 vulnerability in Apache Airflow allows attackers to execute arbitrary scripts within the context of a user's browser. This can lead to unauthorized data access, potential remote code execution, and other malicious activities.
The recommended fix for the CVE-2021-45229 vulnerability is to upgrade to Apache Airflow version 2.2.4 or later. This version includes proper input validation and sanitization to prevent the execution of malicious scripts.
If immediate upgrading is not possible, a temporary workaround is to disable the affected functionality or implement server-side input validation and sanitization measures. This can help mitigate the risk of XSS attacks until a proper fix is applied.
Related vulnerabilities
Recent vulnerabilities recorded for apache-airflow.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
