GHSA-5r62-mjf5-xwhj

Source

https://github.com/advisories/GHSA-5r62-mjf5-xwhj

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/04/GHSA-5r62-mjf5-xwhj/GHSA-5r62-mjf5-xwhj.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-5r62-mjf5-xwhj

Aliases

Downstream

ECHO-d43e-4b7e-6cc8

Published

2025-04-07T09:30:23Z

Modified

2026-08-07T08:12:03Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Apache Airflow Common SQL Provider Vulnerable to SQL Injection

Details

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Airflow Common SQL Provider.

When using the partition clause in SQLTableCheckOperator as parameter (which was a recommended pattern), Authenticated UI User could inject arbitrary SQL command when triggering DAG exposing partition_clause to the user. This allowed the DAG Triggering user to escalate privileges to execute those arbitrary commands which they normally would not have.

This issue affects Apache Airflow Common SQL Provider: before 1.24.1.

Users are recommended to upgrade to version 1.24.1, which fixes the issue.

Database specific

{
    "cwe_ids":  [
        "CWE-89"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-04-07T20:38:25Z",
    "nvd_published_at":  "2025-04-07T09:15:16Z",
    "severity":  "HIGH"
}

References

Affected packages

PyPI / apache-airflow-providers-common-sql

Package

Name: apache-airflow-providers-common-sql; View open source insights on deps.dev
Purl: pkg:pypi/apache-airflow-providers-common-sql

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.24.1

Affected versions

1.*

1.0.0a1

1.0.0rc1

1.0.0

1.1.0rc1

1.1.0rc2

1.1.0rc3

1.1.0rc4

1.1.0

1.2.0rc1

1.2.0

1.3.0rc1

1.3.0

1.3.1rc2

1.3.1rc3

1.3.1

1.3.2rc1

1.3.2rc2

1.3.2

1.3.3rc1

1.3.3

1.3.4rc1

1.3.4

1.4.0rc1

1.4.0

1.5.0rc1

1.5.0rc2

1.5.0

1.5.1rc1

1.5.1

1.5.2rc1

1.5.2

1.6.0rc1

1.6.0rc2

1.6.0

1.6.1rc1

1.6.1

1.6.2rc1

1.6.2

1.7.0rc1

1.7.0

1.7.1rc1

1.7.1

1.7.2rc1

1.7.2

1.8.0rc1

1.8.0

1.8.1rc1

1.8.1

1.9.0rc1

1.9.0

1.10.0rc1

1.10.0

1.10.1rc1

1.10.1

1.11.0rc1

1.11.0rc2

1.11.0rc3

1.11.0

1.11.1rc1

1.11.1

1.12.0rc1

1.12.0

1.13.0rc1

1.13.0

1.14.0rc1

1.14.0

1.14.1rc1

1.14.1

1.14.2rc1

1.14.2

1.15.0rc1

1.15.0

1.16.0rc1

1.16.0

1.17.0rc1

1.17.0

1.17.1rc1

1.17.1

1.18.0rc1

1.18.0

1.19.0rc1

1.19.0

1.20.0rc1

1.20.0

1.21.0rc1

1.21.0rc2

1.21.0

1.22.0

1.23.0rc1

1.23.0

1.24.0rc1

1.24.0

1.24.1b1

1.24.1rc1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/04/GHSA-5r62-mjf5-xwhj/GHSA-5r62-mjf5-xwhj.json"