[GHSA-c392-whpc-vfpr] Apache Airflow vulnerable to Improper Encoding or Escaping of Output

[exolightor]

Updates

• Affected products
• CVSS v3

Comments
Airflow versions < 2.10.0 are not affected by this CVE since the file example_inlet_event_extra.py was added in v2.10.0. Security Scanners like Trivy falsely detect this CVE for versions < 2.10.0.

[exolightor]

Sources: The maintainers mention that the file is introduced in 2.10.0 in the mailing thread: thread (which is also in the description of this Github Advisory DB entry) and we can see that the file was added with the commit c3a5b6e which is only inlcuded in the release tags starting 2.10.0b1.

[advisory-database]

Hi @exolightor! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!