PyPI: apache-airflow
CVE-2024-41937
Safety vulnerability ID: SFTY-20240821-58981
Safety legacy ID: pyup.io-72974
Apache Airflow, in affected versions, contains a vulnerability where a malicious provider could exploit a cross-site scripting (XSS) attack through a provider documentation link. A malicious user could inject a JavaScript URL (e.g., `javascript:prompt(document.domain)`) into the provider's metadata. If a user clicks on this crafted link, it could trigger an XSS attack. The vulnerability requires the malicious provider to be installed on the web server and the user to interact with the malicious link.
Overview
Apache Airflow Cross-site Scripting Vulnerability
Advisory
Apache Airflow, in affected versions, contains a vulnerability where a malicious provider could exploit a cross-site scripting (XSS) attack through a provider documentation link. A malicious user could inject a JavaScript URL (e.g., `javascript:prompt(document.domain)`) into the provider's metadata. If a user clicks on this crafted link, it could trigger an XSS attack. The vulnerability requires the malicious provider to be installed on the web server and the user to interact with the malicious link.
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20240821-58981/CVE-2024-41937
- https://nvd.nist.gov/vuln/detail/CVE-2024-41937
- https://github.com/apache/airflow/pull/40933
- https://lists.apache.org/thread/lwlmgg6hqfmkpvw5py4w53hxyl37jl6d
- https://github.com/apache/airflow/commit/f1852c2ab28b155e196569780013fbb61a4a1f98
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2024-181.yaml
- http://www.openwall.com/lists/oss-security/2024/08/21/3
- https://github.com/advisories/GHSA-w7cp-g8v7-r54m
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more