PyPI/airflow CVE-2019-12417: medium 4.8, EPSS 1.28%

Apache Airflow vulnerable to XSS and local file disclosure

Action: Upgrade airflow to 1.10.6 or later.

pip install airflow==1.10.6

Affected

Fixed versions

Sources

• osv: GHSA-q3p4-gw7r-wqjc
• https://nvd.nist.gov/vuln/detail/CVE-2019-12417
• https://github.com/apache/airflow/commit/caf1f264b845153b9a61b00b1a57acb7c320e743
• https://github.com/advisories/GHSA-q3p4-gw7r-wqjc
• https://github.com/apache/airflow
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2019-216.yaml
• https://lists.apache.org/thread.html/f3aa5ff9c7cdb5424b6463c9013f6cf5db83d26c66ea77130cbbe1bc@%3Cusers.airflow.apache.org%3E

CVE-2019-12417 · published 2019-11-22T13:45:22Z · modified 2026-07-06T08:11:16.165274596Z · JSON