All vulnerabilities
CVE-2023-22884BIT-airflow-2023-22884GHSA-c732-xvv8-g94cPYSEC-2026-268PYSEC-2026-279

apache-airflow: Command Injection in Apache Airflow and Apache Airflow MySQL Provider

Apache Software Foundation apache-airflowpipLibraries & packages
Open in ThreatlineRecord JSON
CVSS
9.8Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)11.1%Chance of exploitation activity in the next 30 days, higher than 95% of CVEs. Scored 27 Oct 2026FIRST EPSS
Fixed in2.5.1Also 4.0.0GitHub
Published21 Jan 2023Updated 27 Oct 2026CVE List

What fixes it

  • 2.5.1apache-airflow, pipGitHub
  • 4.0.0apache-airflow-providers-mysql, pipGitHub
  • 2.5.1Apache AirflowCVE List
  • 4.0.0Apache Airflow MySQL ProviderCVE List
  • 2.5.1apache-airflow, PyPIOSVpip install "apache-airflow>=2.5.1"
  • 4.0.0apache-airflow-providers-mysql, PyPIOSVpip install "apache-airflow-providers-mysql>=4.0.0"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow, Apache Software Foundation Apache Airflow MySQL Provider.This issue affects Apache Airflow: before 2.5.1; Apache Airflow MySQL Provider: before 4.0.0.

Text from CVE List

Affected versions 100

  • apache-airflow, pip< 2.5.1GitHub
  • apache-airflow-providers-mysql, pip< 4.0.0GitHub
  • Apache Airflowaffected: all versions before 2.5.1CVE List
  • Apache Airflow MySQL Provideraffected: all versions before 4.0.0CVE List
  • apache-airflow, PyPIfrom first release, fixed in 2.5.1OSV
  • apache-airflow, PyPI1.10.0OSV
  • apache-airflow, PyPI1.10.1OSV
  • apache-airflow, PyPI1.10.10OSV
  • apache-airflow, PyPI1.10.10rc1OSV
  • apache-airflow, PyPI1.10.10rc2OSV
  • apache-airflow, PyPI1.10.10rc3OSV
  • apache-airflow, PyPI1.10.10rc4OSV
  • apache-airflow, PyPI1.10.10rc5OSV
  • apache-airflow, PyPI1.10.11OSV
  • apache-airflow, PyPI1.10.11rc1OSV
  • apache-airflow, PyPI1.10.11rc2OSV
  • apache-airflow, PyPI1.10.12OSV
  • apache-airflow, PyPI1.10.12rc1OSV
  • apache-airflow, PyPI1.10.12rc2OSV
  • apache-airflow, PyPI1.10.12rc3OSV
  • apache-airflow, PyPI1.10.12rc4OSV
  • apache-airflow, PyPI1.10.13OSV
  • apache-airflow, PyPI1.10.13rc1OSV
  • apache-airflow, PyPI1.10.14OSV
  • apache-airflow, PyPI1.10.14rc1OSV
  • apache-airflow, PyPI1.10.14rc2OSV
  • apache-airflow, PyPI1.10.14rc3OSV
  • apache-airflow, PyPI1.10.14rc4OSV
  • apache-airflow, PyPI1.10.15OSV
  • apache-airflow, PyPI1.10.15rc1OSV
  • apache-airflow, PyPI1.10.1b1OSV
  • apache-airflow, PyPI1.10.1rc2OSV
  • apache-airflow, PyPI1.10.2OSV
  • apache-airflow, PyPI1.10.2b2OSV
  • apache-airflow, PyPI1.10.2rc1OSV
  • apache-airflow, PyPI1.10.2rc2OSV
  • apache-airflow, PyPI1.10.2rc3OSV
  • apache-airflow, PyPI1.10.3OSV
  • apache-airflow, PyPI1.10.3b1OSV
  • apache-airflow, PyPI1.10.3b2OSV
  • apache-airflow, PyPI1.10.3rc1OSV
  • apache-airflow, PyPI1.10.3rc2OSV
  • apache-airflow, PyPI1.10.4OSV
  • apache-airflow, PyPI1.10.4b2OSV
  • apache-airflow, PyPI1.10.4rc1OSV
  • apache-airflow, PyPI1.10.4rc2OSV
  • apache-airflow, PyPI1.10.4rc3OSV
  • apache-airflow, PyPI1.10.4rc4OSV
  • apache-airflow, PyPI1.10.4rc5OSV
  • apache-airflow, PyPI1.10.5OSV
  • apache-airflow, PyPI1.10.5rc1OSV
  • apache-airflow, PyPI1.10.6OSV
  • apache-airflow, PyPI1.10.6rc1OSV
  • apache-airflow, PyPI1.10.6rc2OSV
  • apache-airflow, PyPI1.10.7OSV
  • apache-airflow-providers-mysql, PyPIfrom first release, fixed in 4.0.0OSV
  • apache-airflow-providers-mysql, PyPI1.0.0OSV
  • apache-airflow-providers-mysql, PyPI1.0.0b1OSV
  • apache-airflow-providers-mysql, PyPI1.0.0b2OSV
  • apache-airflow-providers-mysql, PyPI1.0.0rc1OSV
  • apache-airflow-providers-mysql, PyPI1.0.1OSV
  • apache-airflow-providers-mysql, PyPI1.0.1rc1OSV
  • apache-airflow-providers-mysql, PyPI1.0.2OSV
  • apache-airflow-providers-mysql, PyPI1.0.2rc1OSV
  • apache-airflow-providers-mysql, PyPI1.1.0OSV
  • apache-airflow-providers-mysql, PyPI1.1.0rc1OSV
  • apache-airflow-providers-mysql, PyPI2.0.0OSV
  • apache-airflow-providers-mysql, PyPI2.0.0rc1OSV
  • apache-airflow-providers-mysql, PyPI2.0.0rc2OSV
  • apache-airflow-providers-mysql, PyPI2.1.0OSV
  • apache-airflow-providers-mysql, PyPI2.1.0rc1OSV
  • apache-airflow-providers-mysql, PyPI2.1.0rc2OSV
  • apache-airflow-providers-mysql, PyPI2.1.1OSV
  • apache-airflow-providers-mysql, PyPI2.1.1rc1OSV
  • apache-airflow-providers-mysql, PyPI2.2.0OSV
  • apache-airflow-providers-mysql, PyPI2.2.0rc1OSV
  • apache-airflow-providers-mysql, PyPI2.2.0rc2OSV
  • apache-airflow-providers-mysql, PyPI2.2.1OSV
  • apache-airflow-providers-mysql, PyPI2.2.1rc1OSV
  • apache-airflow-providers-mysql, PyPI2.2.2OSV
  • apache-airflow-providers-mysql, PyPI2.2.2rc1OSV
  • apache-airflow-providers-mysql, PyPI2.2.3OSV
  • apache-airflow-providers-mysql, PyPI2.2.3rc1OSV
  • apache-airflow-providers-mysql, PyPI3.0.0OSV
  • apache-airflow-providers-mysql, PyPI3.0.0rc1OSV
  • apache-airflow-providers-mysql, PyPI3.0.0rc2OSV
  • apache-airflow-providers-mysql, PyPI3.1.0OSV
  • apache-airflow-providers-mysql, PyPI3.1.0rc1OSV
  • apache-airflow-providers-mysql, PyPI3.2.0OSV
  • apache-airflow-providers-mysql, PyPI3.2.0rc1OSV
  • apache-airflow-providers-mysql, PyPI3.2.0rc2OSV
  • apache-airflow-providers-mysql, PyPI3.2.0rc3OSV
  • apache-airflow-providers-mysql, PyPI3.2.1OSV
  • apache-airflow-providers-mysql, PyPI3.2.1rc1OSV
  • apache-airflow-providers-mysql, PyPI3.3.0OSV
  • apache-airflow-providers-mysql, PyPI3.3.0rc1OSV
  • apache-airflow-providers-mysql, PyPI3.4.0OSV
  • apache-airflow-providers-mysql, PyPI3.4.0rc2OSV
  • apache-airflow-providers-mysql, PyPI3.4.0rc3OSV
  • apache-airflow-providers-mysql, PyPI4.0.0rc1OSV

References 8