{"action":"Upgrade apache-airflow-providers-google to 22.2.1 or later.","affected":[{"fixed":"22.2.1","introduced":"0"}],"component":"apache-airflow-providers-google","cve_ids":["CVE-2026-49297"],"ecosystem":"PyPI","epss":0.00994,"exploited":false,"fixed_versions":["22.2.1"],"ghsa_id":"GHSA-v3mh-27qj-w836","id":"tcs_01M5KGXCN2XQ95TCCPMX6DVKEP","modified_at":"2026-09-10T11:15:08.155028031Z","published_at":"2026-07-06T11:16:30.207Z","references":["https://osv.dev/vulnerability/PYSEC-2026-2084","http://www.openwall.com/lists/oss-security/2026/07/04/8","https://lists.apache.org/thread/cb5nvoxsj1q7rv878cyqgtg150w0zglq?users@airflow.apache.org","https://github.com/apache/airflow/pull/67667","https://github.com/advisories/GHSA-v3mh-27qj-w836"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"PYSEC-2026-2084","url":"https://osv.dev/vulnerability/PYSEC-2026-2084"}],"summary":"Apache Airflow's Google provider operators `GCSToSFTPOperator` and `GCSTimeSpanFileTransformOperator` joined GCS object names returned by the bucket listing API directly to a destination filesystem pa"}