CVE-2025-54941

Apache Airflow: Command injection in "example_dag_decorator"

MEDIUM 4.6

At a glance

Source: NVD
EPSS: EPSS 0.49 % · percentile 42 (2026-10-28)
State: PUBLISHED
Published: 2025-10-30 09:45 UTC
Updated: 2026-02-26 16:56 UTC
Assigner: apache
NVD status: Modified

Description

An example dag `example_dag_decorator` had non-validated parameter that allowed the UI user to redirect the example to a malicious server and execute code on worker. This however required that the example dags are enabled in production (not default) or the example dag code copied to build your own similar dag. If you used the `example_dag_decorator` please review it and apply the changes implemented in Airflow 3.0.5 accordingly.

Weaknesses (CWE)

CWE-78 — Improper Neutralization of Special Elements used in an OS Command

References

Scores

Version	Score	Vector	Scored by
CVSS 3.1	MEDIUM 4.6	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N	CISA-ADP
CVSS 3.1	MEDIUM 4.6	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N	NVD · nvd@nist.gov (Primary)
CVSS 3.1	MEDIUM 4.6	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N	NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Advisories

GHSA-v3c9-j6h9-66v4 — Apache Airflow has a command injection vulnerability in "example_dag_decorator"
PYSEC-2026-1135 — Apache Airflow has a command injection vulnerability in "example_dag_decorator"

European references

ENISA EUVD · EUVD-2025-36993
GCVE · GCVE-0-2025-54941

Affected configurations (NVD CPE)

cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:* ≥ 3.0.0 < 3.0.5

Affected products

Product	Versions
Apache Software Foundation · Apache Airflow	affected 3.0.0 < < 3.0.5

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD