CVE-2022-24288: OS Command Injection in Apache Airflow
Summary
CVE-2022-24288: In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection from the web UI. Affects apache-airflow versions < 2.2.4. Fixed in 2.2.4. How to fix ↓
Also tracked for
- airflow · Bitnami
The same CVE-2022-24288 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform used for programmatically authoring, scheduling, and monitoring workflows. It allows users to define tasks and their dependencies as directed acyclic graphs (DAGs) and execute them on a distributed infrastructure. The platform is widely adopted for managing data pipelines, ETL processes, and machine learning workflows. However, prior to version 2.2.4, Apache Airflow was found to have a vulnerability that could lead to OS Command Injection from the web UI.
Vulnerability Detail
The vulnerability in Apache Airflow arises from the lack of proper sanitization of user-provided parameters in some example DAGs. This oversight allows an attacker to inject arbitrary operating system commands through the web UI. If successfully exploited, this vulnerability can lead to unauthorized execution of commands with the privileges of the user running the Apache Airflow process. The impact of this vulnerability can range from unauthorized data access to complete compromise of the underlying system.
How To Fix
Latest published version: 3.3.2 as of 22 Oct 2026
pip install --upgrade "apache-airflow==3.3.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.2.4
This is the first release that contains the fix.
pip install --upgrade "apache-airflow==2.2.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of Apache Airflow to mitigate the risk of OS Command Injection.
Conclusion
In conclusion, Apache Airflow prior to version 2.2.4 is vulnerable to OS Command Injection, which can lead to unauthorized execution of commands with the privileges of the Apache Airflow process. It is crucial to upgrade to version 2.2.4 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for apache-airflow →
FAQ
Apache Airflow is an open-source platform used for programmatically authoring, scheduling, and monitoring workflows. It is commonly used for managing data pipelines, ETL processes, and machine learning workflows.
OS Command Injection is a security vulnerability that allows an attacker to execute arbitrary operating system commands on a target system. In the case of Apache Airflow, this vulnerability can be exploited through the web UI by injecting malicious commands.
If successfully exploited, this vulnerability can lead to unauthorized execution of commands with the privileges of the user running the Apache Airflow process. This can result in unauthorized data access, system compromise, and potential further exploitation of the underlying infrastructure.
You can use the Vulert Playground at Vulert Scanner to check if your Apache Airflow installation is affected by this vulnerability. The playground allows you to analyze your Pipfile.lock and provides real-time alerts for open-source vulnerabilities.
You can find more information about this vulnerability in the Apache Airflow advisory database at https://github.com/pypa/advisory-database/blob/main/vulns/apache-airflow/PYSEC-2022-30.yaml
References
Related vulnerabilities
Recent vulnerabilities recorded for apache-airflow.
