description: A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. This also presented a Local File Disclosure vulnerability to any file readable by the webserver process.
problem types: Stored XSS and Local File Disclosure
affected:
{
product: Apache Airflow
vendor: n/a
versions:
status: affected, version: Apache Airflow up to 1.10.5
}