GHSA-52gm-qmg3-r4qp

Apache Airflow: XSS vulnerability in Task Instance Log/Log Details

At a glance

Published: 2024-05-14 18:31 UTC
Updated: 2026-06-05 14:30 UTC
CVE: CVE-2024-32077
Aliases: BIT-airflow-2024-32077, PYSEC-2024-264
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Description

Apache Airflow version 2.9.0 has a vulnerability that allows an authenticated attacker to inject malicious data into the task instance logs. Users are recommended to upgrade to version 2.9.1, which fixes this issue.

Affected packages

Package	Versions
PyPI · apache-airflow	introduced 2.9.0, fixed 2.9.1

References

https://nvd.nist.gov/vuln/detail/CVE-2024-32077 ADVISORY
https://github.com/apache/airflow/pull/38882 WEB
https://github.com/apache/airflow/commit/87acf61f574daf47ce9e03a986e352a2c727f4ce WEB
https://github.com/apache/airflow PACKAGE
https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2024-264.yaml WEB
https://lists.apache.org/thread/gsjmnrqb3m5fzp0vgpty1jxcywo91v77 WEB
http://www.openwall.com/lists/oss-security/2024/05/14/1 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database