title: Apache Airflow <2.4.0 has an RCE in a bash example
description: A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided run_id parameter. This issue affects Apache Airflow Apache Airflow versions prior to 2.4.0.
problem types: CWE-94 Improper Control of Generation of Code ('Code Injection')
affected:
{
vendor: Apache Software Foundation
product: Apache Airflow
versions:
version: Apache Airflow, status: affected, lessThan: 2.4.0, versionType: custom
}
metrics:
other: [
type: unknown
content: {'other': 'low'}
]
workarounds: Do not enable example dags on systems that should not allow UI user to execute an arbitrary command.