CVE-2020-13944: Apache Airflow XSS Vulnerability
Summary
CVE-2020-13944: In Apache Airflow < 1.10.12, the "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. Affects apache-airflow versions < 1.10.12. Fixed in 1.10.12. How to fix ↓
Also tracked for
- airflow · Bitnami
The same CVE-2020-13944 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform used for programmatically authoring, scheduling, and monitoring workflows. It allows users to define complex workflows as Directed Acyclic Graphs (DAGs) of tasks. Apache Airflow provides a web-based user interface for managing and monitoring these workflows. However, versions prior to 1.10.12 are vulnerable to a cross-site scripting (XSS) exploit.
Vulnerability Detail
The vulnerability (CVE-2020-13944) in Apache Airflow versions prior to 1.10.12 is due to the 'origin' parameter passed to certain endpoints, such as '/trigger', being vulnerable to XSS attacks. An attacker can exploit this vulnerability by injecting malicious scripts into the 'origin' parameter, which will be executed when viewed by other users. This can lead to unauthorized access, data theft, or other malicious activities depending on the context in which the vulnerability is exploited.
How To Fix
Latest published version: 3.3.2 as of 22 Oct 2026
pip install --upgrade "apache-airflow==3.3.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.10.12
This is the first release that contains the fix.
pip install --upgrade "apache-airflow==1.10.12"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to manually sanitize the 'origin' parameter before passing it to the vulnerable endpoints. This can be done by implementing input validation and sanitization techniques, such as HTML escaping or using a secure content delivery policy. Here's an example of how to sanitize the 'origin' parameter using HTML escaping in Python:
import html
origin = html.escape(origin)
Conclusion
In conclusion, Apache Airflow versions prior to 1.10.12 are vulnerable to a cross-site scripting (XSS) exploit. It is crucial to upgrade to the latest version or apply the recommended workaround to mitigate the risk of unauthorized access and potential data theft. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apache-airflow →
FAQ
Apache Airflow is an open-source platform used for programmatically authoring, scheduling, and monitoring workflows. It provides a web-based user interface for managing and monitoring workflows.
The vulnerability allows for cross-site scripting (XSS) attacks, which can lead to unauthorized access, data theft, or other malicious activities depending on the context in which the vulnerability is exploited.
To fix this vulnerability, it is recommended to upgrade to Apache Airflow version 1.10.12 or later. This version includes a fix for the XSS vulnerability.
If upgrading to the latest version is not immediately feasible, a temporary workaround is to manually sanitize the 'origin' parameter before passing it to the vulnerable endpoints. This can be done by implementing input validation and sanitization techniques, such as HTML escaping or using a secure content delivery policy.
You can find more information about this vulnerability in the Apache Airflow advisory database: https://github.com/pypa/advisory-database/blob/main/vulns/apache-airflow/PYSEC-2020-19.yaml
Related vulnerabilities
Recent vulnerabilities recorded for apache-airflow.
