{"action":"Upgrade apache-airflow to 1.10.6rc1 or later.","affected":[{"fixed":"1.10.6rc1","introduced":"0"}],"component":"apache-airflow","cve_ids":["CVE-2019-12417"],"ecosystem":"PyPI","epss":0.01277,"exploited":false,"fixed_versions":["1.10.6rc1"],"ghsa_id":"GHSA-q3p4-gw7r-wqjc","id":"tcs_01M5KG914PRQQ96G3SHPT499KE","modified_at":"2026-07-06T08:11:16.165274596Z","published_at":"2019-10-30T22:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2019-216","https://lists.apache.org/thread.html/f3aa5ff9c7cdb5424b6463c9013f6cf5db83d26c66ea77130cbbe1bc@%3Cusers.airflow.apache.org%3E","https://github.com/advisories/GHSA-q3p4-gw7r-wqjc"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2019-216","url":"https://osv.dev/vulnerability/PYSEC-2019-216"}],"summary":"A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. This also presented a Local File Disclosure vulnerability"}