$ cve CVE-2020-11978 JSON

CVE-2020-11978 KEV EXPLOIT

8.8

HIGH · CVSS 3.1 · EPSS 99.2% (pctl 100)

Patch first

On CISA KEV — known exploited in the wild, due 2022-07-18.

Description

An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on the executor in use). If you already have examples disabled by setting load_examples=False in the config then you are not vulnerable.

Scoring

CVSS	8.8 (HIGH, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS	99.19% — more likely to be exploited than 100% of all CVEs
Weakness	CWE-78
On CISA KEV	yes — remediate by 2022-07-18
Public exploit	yes
Published	2020-07-17
Last modified	2026-06-17

CISA KEV

Name	Apache Airflow Command Injection
Added	2022-01-18
Due	2022-07-18
Vendor / product	Apache / Airflow
Ransomware use	none reported

Affected (1)

Vendor	Product
apache	airflow

Public exploits

Source	Title	Date
exploit-db	Apache Airflow 1.10.10 - 'Example Dag' Remote Code Execution	2021-06-02

References

→ the Explorer · watch your stack · NVD