CRITICAL9.8
PYSEC-2026-271
Apache Airflow Hive Provider vulnerable to code injection
Quick fix
PYSEC-2026-271 — apache-airflow-providers-apache-hive: upgrade to the fixed version with the command below.
pip install --upgrade 'apache-airflow-providers-apache-hive>=6.0.0'Details
Apache Software Foundation's Apache Airflow Hive Provider before 6.0.0 is vulnerable to improper control of generation of code.
Are you affected?
Enter the version of the package you're using.
Affected packages
PyPI/apache-airflow-providers-apache-hive
Introduced in:
0Fixed in: 6.0.0Fix
pip install --upgrade 'apache-airflow-providers-apache-hive>=6.0.0'References
- https://nvd.nist.gov/vuln/detail/CVE-2023-28706[ADVISORY]
- https://github.com/apache/airflow/pull/30212[WEB]
- https://github.com/apache/airflow[PACKAGE]
- https://lists.apache.org/thread/dl20xxd51xvlx0zzc0wzgxfjwgtbbxo3[WEB]
- http://www.openwall.com/lists/oss-security/2023/04/07/2[WEB]
- https://pypi.org/project/apache-airflow-providers-apache-hive[PACKAGE]
- https://github.com/advisories/GHSA-5cvg-9pp5-mxcj[ADVISORY]