{"id":"CVE-2022-46421","kind":"vulnerability","aliases":["CVE-2022-46421","GHSA-rc58-qr9j-cpgw"],"related":[],"title":"Apache Airflow Hive Provider vulnerable to Command Injection","description":"Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow Hive Provider.This issue affects Apache Airflow Hive Provider: before 5.0.0.","summary":"The Apache Airflow Hive provider builds shell commands from unsanitized input, so attacker-controlled values can inject extra commands. An attacker who can influence those inputs can run arbitrary commands on the Airflow worker.","severity":"critical","cvss":9.8,"epss":0.03286,"exploited":false,"exploited_at":null,"products":[{"name":"apache-airflow-providers-apache-hive","fixed":["5.0.0"],"affected":"< 5.0.0","ecosystem":"pypi"},{"name":"apache apache-airflow-providers-apache-hive","fixed":["5.0.0"],"affected":"< 5.0.0","ecosystem":"vendor"}],"ecosystems":["pypi","vendor"],"tags":["airflow","cwe-77","data-pipelines","hive","package","python"],"not_affected_if":["hive-provider-not-installed","version-5.0.0-or-later"],"how_to_check":"- Run `pip show apache-airflow-providers-apache-hive` and check whether the version is below `5.0.0`\n- Check whether DAGs or connections pass user-controlled values into Hive operators or hooks","fix":"- Upgrade `apache-airflow-providers-apache-hive` to `5.0.0` or later","status":"open","published_at":"2022-12-20T11:15:09+00:00","first_seen_at":"2026-10-26T21:21:58+00:00","triaged_at":"2026-10-26T21:31:57+00:00","updated_at":"2026-10-26T21:55:22+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-26T21:31:57Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `apache-airflow-providers-apache-hive` to `5.0.0` or later","reach":"unknown","title":"Airflow Hive provider: command injection lets attackers run OS commands","impact":"high","summary":"The Apache Airflow Hive provider builds shell commands from unsanitized input, so attacker-controlled values can inject extra commands. An attacker who can influence those inputs can run arbitrary commands on the Airflow worker.","category":"package","nicknames":[],"who_cares":["airflow","python","data-pipelines","hive"],"confidence":0.8,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary OS commands on the Airflow worker host","analyst_note":"","how_to_check":"- Run `pip show apache-airflow-providers-apache-hive` and check whether the version is below `5.0.0`\n- Check whether DAGs or connections pass user-controlled values into Hive operators or hooks","needs_analyst":false,"not_affected_if":["hive-provider-not-installed","version-5.0.0-or-later"],"who_is_affected":"Teams running Apache Airflow with the Hive provider installed below 5.0.0. Exposure depends on whether untrusted input reaches Hive operators or hooks; deployments where only trusted DAG authors supply values are at lower risk but should still upgrade. Installations without the Hive provider can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000597,"input_tokens":3355,"output_tokens":523,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2022':10A,18A '-46421':11A,19A '-77':35B '5.0.0':104C 'affect':98C 'airflow':2A,22A,29A,33B,44B,75B,94C,100C 'apach':1A,43B,90C,93C,99C 'apache':21A,24A,26A,28A,31A 'apache-airflow-providers-apache-hive':20A,27A 'arbitrari':71B 'attack':55B,63B 'attacker-control':54B 'build':47B 'command':7A,49B,61B,72B,85C,86C 'control':56B 'cpgw':16A 'cve':9A,17A 'cwe':34B 'data':37B 'data-pipelin':36B 'element':81C 'extra':60B 'foundat':92C 'ghsa':13A 'ghsa-rc58-qr9j-cpgw':12A 'hive':3A,25A,32A,39B,45B,95C,101C 'improp':77C 'influenc':66B 'inject':8A,59B,87C 'input':52B,68B 'issu':97C 'neutral':78C 'packag':40B 'pipelin':38B 'provid':4A,46B,102C 'provider.this':96C 'providers':23A,30A 'python':41B 'qr9j':15A 'rc58':14A 'run':70B 'shell':48B 'softwar':91C 'special':80C 'unsanit':51B 'use':82C 'valu':57B 'vulner':5A,88C 'worker':76B","nicknames":[],"mitigations":[],"who_affected":"Teams running Apache Airflow with the Hive provider installed below 5.0.0. Exposure depends on whether untrusted input reaches Hive operators or hooks; deployments where only trusted DAG authors supply values are at lower risk but should still upgrade. Installations without the Hive provider can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2022-12-20T11:15:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-rc58-qr9j-cpgw","url":"https://github.com/advisories/GHSA-rc58-qr9j-cpgw","severity":"critical","published_at":"2022-12-20T12:30:22+00:00","modified_at":"2026-10-26T21:21:17+00:00","first_seen_at":"2026-10-26T21:21:58+00:00","fetched_at":"2026-10-26T21:21:58+00:00","note":null},{"source":"nvd","external_id":"CVE-2022-46421","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-46421","severity":null,"published_at":"2022-12-20T11:15:09+00:00","modified_at":"2026-06-17T05:11:44+00:00","first_seen_at":"2026-10-26T21:55:22+00:00","fetched_at":"2026-10-26T21:55:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}