CVE-2020-9485: Stored XSS vulnerability in Apache Airflow
Summary
CVE-2020-9485: An issue was found in Apache Airflow versions 1.10.10 and below. A stored XSS vulnerability was discovered in the Chart pages of the the "classic" UI. Affects apache-airflow versions < 1.10.11rc1. Fixed in 1.10.11rc1. How to fix ↓
Also tracked for
- airflow · Bitnami
The same CVE-2020-9485 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform used for orchestrating and scheduling workflows. It allows users to define, schedule, and monitor complex workflows as directed acyclic graphs (DAGs). The platform provides a web-based user interface (UI) known as the "classic" UI, which allows users to visualize and interact with their workflows. However, versions 1.10.10 and below of Apache Airflow are vulnerable to a stored cross-site scripting (XSS) attack on the Chart pages of the "classic" UI.
Vulnerability Detail
The stored XSS vulnerability in Apache Airflow allows an attacker to inject malicious scripts into the Chart pages of the "classic" UI. This can occur when user input is not properly sanitized before being displayed on these pages. If a user with sufficient privileges visits a crafted URL or views a specially crafted chart, the injected script will be executed in the context of the user's browser. This can lead to various consequences, such as unauthorized access to sensitive information, session hijacking, or the execution of arbitrary code.
How To Fix
Latest published version: 3.3.2 as of 22 Oct 2026
pip install --upgrade "apache-airflow==3.3.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.10.11rc1
This is the first release that contains the fix.
pip install --upgrade "apache-airflow==1.10.11rc1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version as soon as possible.
Conclusion
In conclusion, Apache Airflow versions 1.10.10 and below are vulnerable to a stored XSS attack in the Chart pages of the "classic" UI. Users should upgrade to version 1.10.11rc1 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apache-airflow →
FAQ
Apache Airflow is an open-source platform used for orchestrating and scheduling workflows.
The "classic" UI is a web-based user interface provided by Apache Airflow for visualizing and interacting with workflows.
A stored XSS vulnerability allows an attacker to inject malicious scripts into a web application, which are then executed by unsuspecting users.
The stored XSS vulnerability in Apache Airflow can lead to unauthorized access to sensitive information, session hijacking, or the execution of arbitrary code.
To fix this vulnerability, users should upgrade to Apache Airflow version 1.10.11rc1 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache-airflow.
