title: Apache Airflow: RCE in example DAGs
description: In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection from the web UI.
problem types: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
affected:
{
product: Apache Airflow
vendor: Apache Software Foundation
versions:
lessThan: 2.2.4, status: affected, version: unspecified, versionType: custom
}
metrics:
other: [
content: {'other': 'high'}
type: unknown
]
workarounds: This can be mitigated by ensuring `[core] load_examples` is set to `False`.