Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-wb11-e3rz-e3cf
Vulnerability ID VCID-wb11-e3rz-e3cf
Aliases CVE-2023-47265
GHSA-pxch-wr7m-rwxj
PYSEC-2023-264
Summary Apache Airflow, versions 2.6.0 through 2.7.3 has a stored XSS vulnerability that allows a DAG author to add an unbounded and not-sanitized javascript in the parameter description field of the DAG. This Javascript can be executed on the client side of any of the user who looks at the tasks in the browser sandbox. While this issue does not allow to exit the browser sandbox or manipulation of the server-side data - more than the DAG author already has, it allows to modify what the user looking at the DAG details sees in the browser - which opens up all kinds of possibilities of misleading other users. Users of Apache Airflow are recommended to upgrade to version 2.8.0 or newer to mitigate the risk associated with this vulnerability
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 5.4 https://github.com/apache/airflow/pull/35460
cvssv3.1 5.4 https://lists.apache.org/thread/128f3zl375vb1qv93k82zhnwkpl233pr
cvssv3.1 5.4 http://www.openwall.com/lists/oss-security/2023/12/21/2
Reference id Reference type URL
https://github.com/apache/airflow
https://github.com/apache/airflow/commit/0b995602e6e5894ee31625a4dd0e6aa255d2a651
https://github.com/apache/airflow/pull/35460
https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-264.yaml
https://lists.apache.org/thread/128f3zl375vb1qv93k82zhnwkpl233pr
http://www.openwall.com/lists/oss-security/2023/12/21/2
CVE-2023-47265 https://nvd.nist.gov/vuln/detail/CVE-2023-47265
GHSA-pxch-wr7m-rwxj https://github.com/advisories/GHSA-pxch-wr7m-rwxj
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/apache/airflow/pull/35460
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at https://lists.apache.org/thread/128f3zl375vb1qv93k82zhnwkpl233pr
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at http://www.openwall.com/lists/oss-security/2023/12/21/2
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

No EPSS data available for this vulnerability.

Date Actor Action Source VulnerableCode Version
2026-06-02T04:20:27.352639+00:00 Pypa Importer Import https://github.com/pypa/advisory-database/blob/main/vulns/apache-airflow/PYSEC-2023-264.yaml 38.6.0