Live › vulnerability › CVE-2022-46421
Go to dashboardThe Apache Airflow Hive provider builds shell commands from unsanitized input, so attacker-controlled values can inject extra commands. An attacker who can influence those inputs can run arbitrary commands on the Airflow worker.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 21:21 UTC, 1h before NVD. All times on this page are UTC.
Teams running Apache Airflow with the Hive provider installed below 5.0.0. Exposure depends on whether untrusted input reaches Hive operators or hooks; deployments where only trusted DAG authors supply values are at lower risk but should still upgrade. Installations without the Hive provider can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| apache-airflow-providers-apache-hive | pypi | < 5.0.0 | 5.0.0 |
| apache apache-airflow-providers-apache-hive | vendor | < 5.0.0 | 5.0.0 |
pip show apache-airflow-providers-apache-hive and check whether the version is below 5.0.0apache-airflow-providers-apache-hive to 5.0.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow Hive Provider.This issue affects Apache Airflow Hive Provider: before 5.0.0.
This page as .md · .json · in your agent: get_signal("CVE-2022-46421")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.