CVE-2019-12417: Apache Airflow Arbitrary JavaScript Execution
Summary
CVE-2019-12417: Apache Airflow vulnerable to XSS and local file disclosure. Affects airflow versions < 1.10.6. Fixed in 1.10.6. How to fix ↓
Also tracked for
- apache-airflow · PyPI
The same CVE-2019-12417 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform used for programmatically authoring, scheduling, and monitoring workflows. It provides a rich set of features for managing and orchestrating complex data pipelines. The vulnerability identified as CVE-2019-12417 allows a malicious admin user to manipulate the state of objects in the Airflow metadata database, leading to the execution of arbitrary JavaScript on certain page views. Additionally, this vulnerability exposes a Local File Disclosure risk, enabling access to any file readable by the webserver process.
Vulnerability Detail
The vulnerability arises from the ability of an admin user to modify the state of objects in the Airflow metadata database. By tampering with the object state, an attacker can inject and execute arbitrary JavaScript code on specific page views. This can lead to various consequences, such as unauthorized access, data leakage, or the execution of malicious actions within the application. Furthermore, the Local File Disclosure aspect of the vulnerability allows the attacker to access sensitive files accessible to the webserver process.
How To Fix
Latest published version: 0.6.0 as of 22 Oct 2026
pip install --upgrade "airflow==0.6.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.10.6
This is the first release that contains the fix.
pip install --upgrade "airflow==1.10.6"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict admin privileges to trusted individuals only. By limiting access to the admin role, the potential for exploitation of this vulnerability can be reduced. However, this is not a permanent solution and should be considered as a temporary measure until the upgrade to a secure version is completed.
Conclusion
The CVE-2019-12417 vulnerability in Apache Airflow allows a malicious admin user to execute arbitrary JavaScript code and exposes a Local File Disclosure risk. To mitigate this vulnerability, it is crucial to upgrade to Apache Airflow version 1.10.6 or later. Restricting admin privileges to trusted individuals can serve as a temporary workaround. For further support and assistance in vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for airflow →
FAQ
Apache Airflow is an open-source platform used for programmatically authoring, scheduling, and monitoring workflows. It provides a rich set of features for managing and orchestrating complex data pipelines.
This vulnerability allows a malicious admin user to execute arbitrary JavaScript code on certain page views and exposes a Local File Disclosure risk. It can lead to unauthorized access, data leakage, and the execution of malicious actions within the application.
To fix this vulnerability, it is recommended to upgrade to Apache Airflow version 1.10.6 or later. This version includes the necessary patches and security enhancements to mitigate the arbitrary JavaScript execution and Local File Disclosure risks.
As a temporary workaround, users can restrict admin privileges to trusted individuals only. By limiting access to the admin role, the potential for exploitation of this vulnerability can be reduced. However, this is not a permanent solution and should be considered as a temporary measure until the upgrade to a secure version is completed.
For more information about this vulnerability, you can refer to the official CVE-2019-12417 advisory or reach out to the Apache Airflow community for assistance.
Related vulnerabilities
Recent vulnerabilities recorded for airflow.
