Skip to content
OpenAdvisories
Medium · 6.1 CVE-2022-43982 BIT-airflow-2022-43982EUVD-2022-0014GHSA-h63r-9xxf-f2c7PYSEC-2022-42970

Apache Airflow prior to 2.4.2 allows reflected XSS via Origin Query Argument in URL

Published Nov 2, 2022 · Updated May 2, 2025 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Airflow Package: apache-airflow Ecosystem: PyPI

Description

In Apache Airflow versions prior to 2.4.2, the "Trigger DAG with config" screen was susceptible to XSS attacks via the `origin` query argument.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Airflow unspecified – < 2.4.2 2.4.2

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI apache-airflow < 2.4.2rc1 2.4.2rc1 GHSA-h63r-9xxf-f2c7
PyPI apache-airflow < 2.4.2 2.4.2 PYSEC-2022-42970

References