{"schema":"threatline.record/2","record":{"id":"CVE-2023-25691","aliases":["GHSA-8g23-2q5p-8866","PYSEC-2026-277"],"summary":"Apache Airflow Google Provider Improper Input Validation vulnerability","details":"Improper Input Validation vulnerability in the Apache Airflow Google Provider. This issue affects Apache Airflow Google Provider versions before 8.10.0.","categories":["Libraries & packages"],"product":"apache-airflow-providers-google","vendor":"Apache Software Foundation","ecosystem":"pip","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-8g23-2q5p-8866","source_modified_at":"2026-10-26T21:16:36Z","fetched_at":"2026-10-26T23:45:56.352924Z","package":{"ecosystem":"pip","name":"apache-airflow-providers-google"},"range":"< 8.10.0"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2023-25691","source_modified_at":"2025-03-11T20:44:52.284Z","fetched_at":"2026-10-26T23:45:56.352924Z","product":"Apache Airflow Google Provider","vendor":"Apache Software Foundation","versions":[{"lessThan":"8.10.0","status":"affected","version":"0","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-8g23-2q5p-8866","source_modified_at":"2026-10-26T21:30:04.157195437Z","fetched_at":"2026-10-26T23:45:56.352924Z","package":{"name":"apache-airflow-providers-google","ecosystem":"PyPI","purl":"pkg:pypi/apache-airflow-providers-google"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.10.0"}]}],"versions":["1.0.0","1.0.0b1","1.0.0b2","1.0.0rc1","2.0.0","2.0.0rc1","2.1.0","2.1.0rc1","2.2.0","2.2.0rc1","3.0.0","3.0.0rc1","4.0.0","4.0.0rc1","4.0.0rc2","4.1.0rc1","5.0.0","5.0.0rc2","5.1.0","5.1.0rc1","6.0.0","6.0.0rc1","6.1.0","6.1.0rc1","6.2.0","6.2.0rc1","6.3.0","6.3.0rc1","6.4.0","6.4.0rc1","6.4.0rc2","6.4.0rc3","6.5.0","6.5.0rc1","6.6.0","6.6.0rc1","6.7.0","6.7.0rc1","6.8.0","6.8.0rc1","7.0.0","7.0.0rc1","8.0.0","8.0.0rc1","8.0.0rc2","8.1.0","8.1.0rc1","8.10.0rc1","8.2.0","8.2.0rc1"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-8g23-2q5p-8866","source_modified_at":"2026-10-26T21:16:36Z","fetched_at":"2026-10-26T23:45:56.352924Z","package":{"ecosystem":"pip","name":"apache-airflow-providers-google"},"version":"8.10.0"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2023-25691","source_modified_at":"2025-03-11T20:44:52.284Z","fetched_at":"2026-10-26T23:45:56.352924Z","package":{"name":"Apache Airflow Google Provider","ecosystem":null},"version":"8.10.0","basis":"first unaffected version stated in the CVE record"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-8g23-2q5p-8866","source_modified_at":"2026-10-26T21:30:04.157195437Z","fetched_at":"2026-10-26T23:45:56.352924Z","package":{"name":"apache-airflow-providers-google","ecosystem":"PyPI","purl":"pkg:pypi/apache-airflow-providers-google"},"version":"8.10.0"}],"cvss":9.8,"severity":"Critical","kev":{"listed":false},"epss":{"probability":0.01597,"percentile":0.75576,"score_date":"2026-10-26"},"published_at":"2023-02-24T11:35:49.091Z","modified_at":"2026-10-26T21:30:04.157195437Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-8g23-2q5p-8866","fetched_at":"2026-10-26T23:45:56.352924Z","source_modified_at":"2026-10-26T21:16:36Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2023-25691","fetched_at":"2026-10-26T23:45:56.352924Z","source_modified_at":"2025-03-11T20:44:52.284Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-8g23-2q5p-8866","fetched_at":"2026-10-26T23:45:56.352924Z","source_modified_at":"2026-10-26T21:30:04.157195437Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-25691","fetched_at":"2026-10-26T23:45:56.352924Z","source_modified_at":"2026-10-26"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25691","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/apache/airflow/pull/29497","tags":["patch","x_transferred"]},{"source":"CVE List","url":"https://lists.apache.org/thread/zdr8ovfttbh7kj0lydgcw88tbt2nmkcy","tags":["vendor-advisory","x_transferred"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow-providers-google/PYSEC-2026-277.yaml","source":"GitHub Advisory Database"},{"url":"https://pypi.org/project/apache-airflow-providers-google","source":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-8g23-2q5p-8866","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"total","assessed_at":"2025-03-11T20:44:42.825490Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-26T21:30:04.157195437Z","content_hash":"cae690cf9f8920a2a133ca32eee402a00104d50d8ca88effc8c934ac546ab596"}}