PyPI/apache-airflow CVE-2022-40954: medium 5.5, EPSS 1.38%

OS Command Injection in Apache Airflow

Action: Upgrade apache-airflow to 2.3.0 or later.

pip install apache-airflow==2.3.0

Affected

Fixed versions

Sources

• osv: GHSA-45r6-j3cc-6mxx
• https://nvd.nist.gov/vuln/detail/CVE-2022-40954
• https://github.com/apache/airflow/pull/27646
• https://github.com/apache/airflow
• https://lists.apache.org/thread/0tmdlnmjs5t4gsx5fy73tb6zd3jztq45

CVE-2022-40954 · published 2022-11-22T12:30:22Z · modified 2026-07-07T11:56:37.423642822Z · JSON