-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| apache-airflow | pip | < 2.5.1 | 2.5.1 |
| apache-airflow-providers-mysql | pip | < 4.0.0 | 4.0.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper handling of the 'local_infile' parameter in MySQL connections. The GitHub PR #28811 explicitly moves this parameter from connection extras to hook parameters, indicating it was previously vulnerable to injection via user-controlled connection configurations. This parameter controls MySQL's LOCAL INFILE capability, which if maliciously enabled/configured, could lead to arbitrary command execution. The affected versions allowed this dangerous setting via connection extras, making the get_conn function (which processes connection parameters) the injection vector.