CVE-2020-9485: Stored XSS in Apache Airflow
Summary
CVE-2020-9485: Stored XSS in Apache Airflow. Affects apache-airflow versions < 1.10.11. Fixed in 1.10.11. How to fix ↓
Also tracked for
- airflow · Bitnami
The same CVE-2020-9485 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform used for programmatically authoring, scheduling, and monitoring workflows. It provides a rich set of features for managing complex data pipelines. However, versions 1.10.10 and below of Apache Airflow are vulnerable to a stored cross-site scripting (XSS) attack. This vulnerability specifically affects the Chart pages of the classic user interface.
Vulnerability Detail
The stored XSS vulnerability in Apache Airflow allows an attacker to inject malicious scripts into the Chart pages of the classic UI. This can occur when user-supplied input is not properly validated or sanitized before being displayed to other users. As a result, an attacker can craft a malicious payload that, when executed by a victim user, can lead to unauthorized actions, data theft, or further exploitation. The severity of this vulnerability is rated as moderate with a CVSS score of 6.1.
How To Fix
Latest published version: 3.3.2 as of 22 Oct 2026
pip install --upgrade "apache-airflow==3.3.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.10.11
This is the first release that contains the fix.
pip install --upgrade "apache-airflow==1.10.11"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the classic UI and switch to the newer experimental UI, which is not affected by this vulnerability. This can be done by modifying the Airflow configuration file to set 'web_server_class' to 'airflow.www_rbac.app:cached_app' instead of 'airflow.www.app:cached_app'. However, this workaround may not be suitable for all users, and upgrading to the latest version is still the recommended solution.
Conclusion
In conclusion, Apache Airflow versions 1.10.10 and below are vulnerable to a stored XSS attack in the Chart pages of the classic UI. Users should upgrade to version 1.10.11 or above to mitigate this vulnerability. Alternatively, a temporary workaround is available by disabling the classic UI and switching to the experimental UI. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apache-airflow →
FAQ
Apache Airflow is an open-source platform used for programmatically authoring, scheduling, and monitoring workflows. It provides a rich set of features for managing complex data pipelines.
Stored cross-site scripting (XSS) is a type of vulnerability where an attacker can inject malicious scripts into a website or application. These scripts are then stored and executed by other users, leading to potential unauthorized actions or data theft.
The stored XSS vulnerability in Apache Airflow can allow an attacker to execute arbitrary scripts on the Chart pages of the classic UI. This can lead to unauthorized actions, data theft, or further exploitation of the affected system.
To fix this vulnerability, it is recommended to upgrade to Apache Airflow version 1.10.11 or above. This version includes a patch that addresses the stored XSS issue. Users should update their installations as soon as possible.
Yes, a temporary workaround is to disable the classic UI and switch to the newer experimental UI, which is not affected by this vulnerability. This can be done by modifying the Airflow configuration file.
Related vulnerabilities
Recent vulnerabilities recorded for apache-airflow.
