Most recent entries from all https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 11 Oct 2026 00:20:40 +0000 CVE-2025-30473 — Apache Airflow Common SQL Provider: Remote Code Execution via Sql Injection https://vulnerability.circl.lu/vuln/cve-2025-30473 <p><strong>Affected:</strong> Apache Software Foundation Apache Airflow Common SQL Provider</p> <p>Improper Neutralization of Special Elements used in an SQL Command (&#39;SQL Injection&#39;) vulnerability in Apache Airflow Common SQL Provider.</p> <p>When using the partition clause in SQLTableCheckOperator as parameter (which was a recommended pattern), Authenticated UI User could inject arbitrary SQL command when triggering DAG exposing partition_clause to the user. This allowed the DAG Triggering user to escalate privileges to execute those arbitrary commands which they normally would not have.</p> <p>This issue affects Apache Airflow Common SQL Provider: before 1.24.1.</p> <p>Users are recommended to upgrade to version 1.24.1, which fixes the issue.</p> <p><strong>Affected:</strong> Apache Software Foundation Apache Airflow Common SQL Provider</p> <p>Improper Neutralization of Special Elements used in an SQL Command (&#39;SQL Injection&#39;) vulnerability in Apache Airflow Common SQL Provider.</p> <p>When using the partition clause in SQLTableCheckOperator as parameter (which was a recommended pattern), Authenticated UI User could inject arbitrary SQL command when triggering DAG exposing partition_clause to the user. This allowed the DAG Triggering user to escalate privileges to execute those arbitrary commands which they normally would not have.</p> <p>This issue affects Apache Airflow Common SQL Provider: before 1.24.1.</p> <p>Users are recommended to upgrade to version 1.24.1, which fixes the issue.</p> https://vulnerability.circl.lu/vuln/cve-2025-30473 GHSA-5r62-mjf5-xwhj — Apache Airflow Common SQL Provider Vulnerable to SQL Injection https://vulnerability.circl.lu/vuln/ghsa-5r62-mjf5-xwhj <p><strong>Affected:</strong> PyPI: apache-airflow-providers-common-sql</p> <p>Improper Neutralization of Special Elements used in an SQL Command (&#39;SQL Injection&#39;) vulnerability in Apache Airflow Common SQL Provider.</p> <p>When using the partition clause in SQLTableCheckOperator as parameter (which was a recommended pattern), Authenticated UI User could inject arbitrary SQL command when triggering DAG exposing partition_clause to the user. This allowed the DAG Triggering user to escalate privileges to execute those arbitrary commands which they normally would not have.</p> <p>This issue affects Apache Airflow Common SQL Provider: before 1.24.1.</p> <p>Users are recommended to upgrade to version 1.24.1, which fixes the issue.</p> <p><strong>Affected:</strong> PyPI: apache-airflow-providers-common-sql</p> <p>Improper Neutralization of Special Elements used in an SQL Command (&#39;SQL Injection&#39;) vulnerability in Apache Airflow Common SQL Provider.</p> <p>When using the partition clause in SQLTableCheckOperator as parameter (which was a recommended pattern), Authenticated UI User could inject arbitrary SQL command when triggering DAG exposing partition_clause to the user. This allowed the DAG Triggering user to escalate privileges to execute those arbitrary commands which they normally would not have.</p> <p>This issue affects Apache Airflow Common SQL Provider: before 1.24.1.</p> <p>Users are recommended to upgrade to version 1.24.1, which fixes the issue.</p> https://vulnerability.circl.lu/vuln/ghsa-5r62-mjf5-xwhj