Apache Airflow Command Injection Vulnerability in Example DAG Decorator

A command injection vulnerability has been identified in the Apache Airflow example DAG named 'example_dag_decorator'. This issue arises from a non-validated parameter that allows a user to redirect the example to a malicious server and execute code on the worker. Exploitation requires that example DAGs are enabled in production, which is not the default setting, or that the example DAG code is copied to create a similar DAG. Affected versions include Apache Airflow versions greater than 3.0.0 and prior to 3.0.5.

Impact

Exploitation of this vulnerability could lead to unauthorized code execution on the Airflow worker.

Remediation

Users who have utilized the 'example_dag_decorator' should review it and apply the updates introduced in Apache Airflow version 3.0.5.