CVE-2025-54550

Katalog CVE

CVSS 8.1 · High EPSS 0,58%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada apache airflow. Skor CVSS 3.1 8.1 (High) menurut CISA ADP.

Deskripsi (NVD)

The example example_xcom that was included in airflow documentation implemented unsafe pattern of reading value from xcom in the way that could be exploited to allow UI user who had access to modify XComs to perform arbitrary execution of code on the worker. Since the UI users are already highly trusted, this is a Low severity vulnerability. It does not affect Airflow release - example_dags are not supposed to be enabled in production environment, however users following the example could replicate the bad pattern. Documentation of Airflow 3.2.0 contains version of the example with improved resiliance for that case. Users who followed that pattern are advised to adjust their implementations accordingly.

Rincian

Terbit di NVD

15 April 2026

Terakhir diubah

7 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

0,58% peluang dieksploitasi; lebih tinggi dari 46,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/3mf4cfx070ofsnf9qy0s2v5gqb5sc2g1 mailing list · advisory vendor
• http://www.openwall.com/lists/oss-security/2026/04/15/1 mailing list · advisory pihak ketiga
• https://github.com/apache/airflow/pull/63200 issue tracking