CVE-2024-41937

Advisory

Apache Airflow, in affected versions, contains a vulnerability where a malicious provider could exploit a cross-site scripting (XSS) attack through a provider documentation link. A malicious user could inject a JavaScript URL (e.g., `javascript:prompt(document.domain)`) into the provider's metadata. If a user clicks on this crafted link, it could trigger an XSS attack. The vulnerability requires the malicious provider to be installed on the web server and the user to interact with the malicious link.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/apache/airflow/commit/f1852c2ab28b155e196569780013fbb61a4a1f98
• https://github.com/apache/airflow/pull/40933
• https://github.com/advisories/GHSA-w7cp-g8v7-r54m
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41937