{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"2.1.0"}],"component":"airflow-diagrams","cve_ids":["CVE-2024-28423"],"ecosystem":"PyPI","epss":0.00779,"exploited":false,"fixed_versions":[],"id":"tcs_01M5KGMT5MJPPYGMMYFNANB4RG","modified_at":"2026-07-30T12:56:29.142951614Z","published_at":"2024-03-14T19:15:50.877Z","references":["https://osv.dev/vulnerability/PYSEC-2024-263","https://github.com/bayuncao/vul-cve-15","https://github.com/feluelle/airflow-diagrams"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"PYSEC-2024-263","url":"https://osv.dev/vulnerability/PYSEC-2024-263"}],"summary":"Airflow-Diagrams v2.1.0 was discovered to contain an arbitrary file upload vulnerability in the unsafe_load function at cli.py. This vulnerability allows attackers to execute arbitrary code via upload"}