MEDIUM6.1

PYSEC-2022-29

Quick fix

PYSEC-2022-29 — apache-airflow: upgrade to the fixed version with the command below.

pip install --upgrade 'apache-airflow>=2.2.4rc1'

Details

It was discovered that the "Trigger DAG with config" screen was susceptible to XSS attacks via the `origin` query argument. This issue affects Apache Airflow versions 2.2.3 and below.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/apache-airflow

Introduced in: 0Fixed in: 2.2.4rc1

Fixpip install --upgrade 'apache-airflow>=2.2.4rc1'

References

https://lists.apache.org/thread/phx76cgtmhwwdy780rvwhobx8qoy4bnk[WEB]
https://github.com/advisories/GHSA-65xw-pcqw-hjrh[ADVISORY]