Skip to content
OpenAdvisories
Medium · 5.4 CVE-2023-29247 BIT-airflow-2023-29247EUVD-2023-0030GHSA-vcf6-3wv2-5vcrPYSEC-2023-60

Stored XSS on Apache Airflow

Published May 8, 2023 · Updated Oct 15, 2024 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Airflow Package: apache-airflow Ecosystem: PyPI

Description

Task instance details page in the UI is vulnerable to a stored XSS.This issue affects Apache Airflow: before 2.6.0.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Airflow < 2.6.0 2.6.0

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI apache-airflow < 2.6.0 2.6.0 GHSA-vcf6-3wv2-5vcr

References