> CVE-2025-54941

« BACK_TO_HOME
PUBLISHED
2025-10-30 10:15
MODIFIED
2025-10-30 10:15
EPSS (Prob. Exploit)
0.49%
Top 57.5%
DATA SOURCES:
NVD 🔗 2025-10-30 CVE PROJECT 🔗 2026-01-19 CWE MITRE 🔗 2026-11-01 FIRST EPSS 🔗 2026-11-08 GITHUB 🔗 2026-10-28 OSV 🔗 2026-11-08

> DESCRIPTION

An example dag `example_dag_decorator` had non-validated parameter that allowed the UI user to redirect the example to a malicious server and execute code on worker. This however required that the example dags are enabled in production (not default) or the example dag code copied to build your own similar dag. If you used the `example_dag_decorator` please review it and apply the changes implemented in Airflow 3.0.5 accordingly.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> WEAKNESSES

CWE-78

> CWE DETAILED DESCRIPTIONS

CWE-78: Improper Neutralization of Special Elements used in an OS Command - The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.

> GITHUB SECURITY ADVISORY

GHSA-v3c9-j6h9-66v4 MODERATE

Apache Airflow has a command injection vulnerability in "example_dag_decorator"

AFFECTED PACKAGES:
PIP / apache-airflow
>= 3.0.0, < 3.0.5
Fixed in: 3.0.5

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

Apache Airflow: Command injection in "example_dag_decorator"

AFFECTED PACKAGES:
Unknown / Unknown
ALIASES:
BIT-airflow-2025-54941, GHSA-v3c9-j6h9-66v4, PYSEC-2026-1135

> HISTORIQUE DES MODIFICATIONS

Première apparition
30/10/2025 10:15
Source: NVD
📊 ENRICHISSEMENT 01/11/2026 06:58
CWE
Champ modifié: Description CWE
Ancienne valeur:
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') - The product constructs all or part of an OS command using externally-influenced input from an upstr...
Nouvelle valeur:
CWE-78: Improper Neutralization of Special Elements used in an OS Command - The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it doe...
📊 ENRICHISSEMENT 19/01/2026 17:36
CVEPROJECT
Champ modifié: CVE Project
Ancienne valeur:
Non
Nouvelle valeur:
Oui
📊 ENRICHISSEMENT 01/11/2025 06:01
CWE
Champ modifié: Description CWE
Ancienne valeur:
N/A
Nouvelle valeur:
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') - The product constructs all or part of an OS command using externally-influenced input from an upstr...
Total des modifications: 3 Dernière mise à jour: 1 week ago

> REFERENCES

https://lists.apache.org/thread/c6q6nofc6xl5bms039ks9b34v0v36df1
« BACK_TO_HOME