Live › vulnerability › CVE-2023-22884
Go to dashboardApache Airflow and its MySQL provider mishandle special characters in a command, so crafted input can inject operating system commands. An attacker who can influence that input can run commands as the Airflow process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 15:13 UTC, 0h before NVD. All times on this page are UTC.
Teams running Apache Airflow before 2.5.1 with the MySQL provider before 4.0.0 installed. The sources do not say which DAG or connection configurations reach the vulnerable code path, so assume any deployment with that provider is exposed. Teams on the fixed versions can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| apache-airflow | pypi | < 2.5.1 | 2.5.1 |
| apache-airflow-providers-mysql | pypi | < 4.0.0 | 4.0.0 |
| apache airflow | vendor | < 2.5.1 | 2.5.1 |
| apache apache-airflow-providers-mysql | vendor | < 4.0.0 | 4.0.0 |
pip show apache-airflow and confirm the version is below 2.5.1pip show apache-airflow-providers-mysql and confirm the version is below 4.0.0apache-airflow to 2.5.1 or laterapache-airflow-providers-mysql to 4.0.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow, Apache Software Foundation Apache Airflow MySQL Provider.This issue affects Apache Airflow: before 2.5.1; Apache Airflow MySQL Provider: before 4.0.0.
This page as .md · .json · in your agent: get_signal("CVE-2023-22884")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.