Read the docs
TI-2023-25582 Aliases CVE-2023-47265GHSA-pxch-wr7m-rwxj

Apache Airflow: DAG Params alllow to embed unchecked Javascript

Priority LOW 27CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Apache Airflow, versions 2.6.0 through 2.7.3 has a stored XSS vulnerability that allows a DAG author to add an unbounded and not-sanitized javascript in the parameter description field of the DAG. This Javascript can be executed on the client side of any of the user who looks at the tasks in the browser sandbox. While this issue does not allow to exit the browser sandbox or manipulation of the server-side data - more than the DAG author already has, it allows to modify what the user looking at the DAG details sees in the browser - which opens up all kinds of possibilities of misleading other users. Users of Apache Airflow are recommended to upgrade to version 2.8.0 or newer to mitigate the risk associated with this vulnerability

Why it matters now

EPSS 0.01344 71st percentileScored 2026-11-07
Fix Fixed Apache Airflow (Apache Software Foundation): 2.8.0apache-airflow (PyPI): 2.8.0b1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Airflow2.6.0 to before 2.8.02.8.0Patch availableCNA
—apache-airflow (PyPI)2.6.0 to before 2.8.0b12.8.0b1Patch availableGHSA-pxch-wr7m-rwxj
  • Apache Airflow VendorApache Affected 2.6.0 to before 2.8.0 Fixed in 2.8.0 Patch available CNA
  • apache-airflow (PyPI) Vendor— Affected 2.6.0 to before 2.8.0b1 Fixed in 2.8.0b1 Patch available GHSA-pxch-wr7m-rwxj

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*2.6.0 – 2.7.3VulnerableApache
  • cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:* Versions 2.6.0 – 2.7.3 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Airflow (Apache Software Foundation) Fixed in 2.8.0
  • Fix · GHSA-pxch-wr7m-rwxj apache-airflow (PyPI) Fixed in 2.8.0b1 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Apache Airflow 2.8.0

    4 records Highest priority Priority LOW 4 LOW

    Other records, highest priority first

    • TI-2023-27713 Apache Airflow: Improper access control vulnerability on the "varimport" endpointPriority LOW 32
    • TI-2023-27290 Apache Airflow: Missing CSRF protection on DAG/triggerPriority LOW 31
    • TI-2023-26154 Apache Airflow: Improper access control to DAG resourcesPriority LOW 24
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-47265
  2. 2026-10-03 Alias added: GHSA-pxch-wr7m-rwxj

References

Patch 1

Advisory 3

Other 3

  • TI-2020-10905 Missing authentication in Apache Airflow KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-09638 OS command injection in Apache Airflow KEVCVSS 3.1HIGH 8.8
  • TI-2022-19017 Apache Airflow <2.4.0 has an RCE in a bash example CVSS 3.1HIGH 8.8
  • TI-2021-16140 Apache Airflow: Variable Import endpoint missed authentication check CVSS 3.1CRITICAL 9.8
  • TI-2022-08169 Apache Airflow: RCE in example DAGs CVSS 3.1HIGH 8.8
  • TI-2024-26776 Apache Airflow: DAG Author Code Execution possibility in airflow-scheduler CVSS 3.1HIGH 8.8
See all 157 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences