A critical security vulnerability has been detected in the Apache Airflow MySQL Provider library that could allow threat actors to execute remote code in affected installations. Apache Airflow is an open-source workflow management platform used to programmatically write, schedule, and monitor workflows. The MySQL Provider is a library used to provide a MySQL connection.
The vulnerability, identified by the code CVE-2023-22884, is a command injection security vulnerability affecting versions of Apache Airflow prior to 2.5.1 and Apache Airflow MySQL Provider prior to 4.0.0. A remote threat actor can execute arbitrary commands on the target system by sending specially crafted data to the application.
It is recommended to upgrade to the current versions that fix the vulnerability as soon as possible to avoid being targeted by attacks that can be carried out using the vulnerability.
