CVE-2025-54941: Apache Airflow: Command injection in "example_dag_decorator"

--000000000000a2e72e06425093cf
Content-Type: text/plain; charset="UTF-8"

CVE-2025-54941: Apache Airflow: Command injection in "example_dag_decorator"

Severity: low

Affected versions:

- Apache Airflow (apache-airflow) >3.0.0, < 3.0.5

Description:

An example dag `example_dag_decorator` had non-validated parameter that
allowed the UI user to redirect the example to a malicious server and
execute code on worker. This however required that the example dags are
enabled in production (not default) or the example dag code copied to build
your own similar dag.

If you used the `example_dag_decorator` please review it and apply the
changes implemented in Airflow 3.0.5 accordingly.

Credit:

Nacl (reporter)

References:

https://airflow.apache.org/
https://www.cve.org/CVERecord?id=CVE-2025-54941

--000000000000a2e72e06425093cf
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">CVE-2025-54941: Apache Airflow: Command injection in &quot=
;example_dag_decorator&quot;<br><br>Severity: low <br><br>Affected versions=
:<br><br>- Apache Airflow (apache-airflow) &gt;3.0.0, &lt; 3.0.5<br><br>Des=
cription:<br><br>An example dag `example_dag_decorator` had non-validated p=
arameter that allowed the UI user to redirect the example to a malicious se=
rver and execute code on worker. This however required that the example dag=
s are enabled in production (not default) or the example dag code copied to=
 build your own similar dag.=C2=A0<div><br></div><div>If you used the `exam=
ple_dag_decorator` please review it and apply the changes implemented in Ai=
rflow 3.0.5 accordingly.<br><br>Credit:<br><br>Nacl (reporter)<br><br>Refer=
ences:<br><br><a href=3D"https://airflow.apache.org/">https://airflow.apach=
e.org/</a><br><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-54941"=
>https://www.cve.org/CVERecord?id=3DCVE-2025-54941</a><br></div></div>

--000000000000a2e72e06425093cf--