CVE-2021-45229: Apache Airflow XSS Vulnerability
Summary
CVE-2021-45229: It was discovered that the "Trigger DAG with config" screen was susceptible to XSS attacks via the origin query argument. Affects apache-airflow versions < 2.2.4rc1. Fixed in 2.2.4rc1. How to fix ↓
Also tracked for
- airflow · Bitnami
The same CVE-2021-45229 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform used for programmatically authoring, scheduling, and monitoring workflows. It provides a rich set of features for managing and executing complex data pipelines. The vulnerability identified as CVE-2021-45229 affects Apache Airflow versions 2.2.3 and below.
Vulnerability Detail
The "Trigger DAG with config" screen in Apache Airflow is susceptible to cross-site scripting (XSS) attacks through the origin query argument. This allows an attacker to inject malicious scripts into the web application, potentially leading to unauthorized access, data theft, or other malicious activities. The vulnerability was discovered on February 25, 2022, and has been assigned the identifier PYSEC-2022-29. It has also been associated with the aliases CVE-2021-45229 and GHSA-65xw-pcqw-hjrh.
How To Fix
Latest published version: 3.3.2 as of 22 Oct 2026
pip install --upgrade "apache-airflow==3.3.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.2.4rc1
This is the first release that contains the fix.
pip install --upgrade "apache-airflow==2.2.4rc1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the affected functionality or implement input validation and output encoding to prevent the execution of malicious scripts. Here is an example of input validation using Python and the Flask framework:
from flask import request, abort
origin = request.args.get('origin')
if not origin or not origin.isalnum():
abort(400, 'Invalid origin parameter')
This code snippet checks if the origin parameter is alphanumeric and returns a 400 Bad Request response if it is not.
Conclusion
In conclusion, the CVE-2021-45229 vulnerability in Apache Airflow exposes the "Trigger DAG with config" screen to cross-site scripting attacks. It is crucial for users to upgrade to Apache Airflow version 2.2.4rc1 or later to mitigate this vulnerability. Additionally, implementing input validation and output encoding can serve as a temporary workaround. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apache-airflow →
FAQ
Apache Airflow is an open-source platform used for programmatically authoring, scheduling, and monitoring workflows. It provides a rich set of features for managing and executing complex data pipelines.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to unauthorized access, data theft, or other malicious activities.
You can use the Vulert Playground at Vulert Scanner to check if your Apache Airflow installation is affected by this vulnerability. Simply enter your Pipfile.lock and the playground will provide real-time alerts for open-source vulnerabilities.
Yes, a fix is available in Apache Airflow version 2.2.4rc1 and later. It is recommended to upgrade your installation to mitigate the XSS vulnerability.
As a temporary workaround, you can disable the affected functionality or implement input validation and output encoding to prevent the execution of malicious scripts. Refer to the provided code snippet for an example of input validation using Python and the Flask framework.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache-airflow.
