-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from insufficient validation of the run_id parameter in three key areas: 1) DagRun creation logic in dag.py lacked regex checks, 2) The DagRun model in dagrun.py had no validation constraints, and 3) The web trigger endpoint in views.py didn't properly sanitize input. The patch introduced regex validation (allowed_run_id_pattern) and explicit checks in all these locations, confirming these were the vulnerable points. The CWE-22 classification and commit diff showing added validation in these functions further validate this analysis.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| apache-airflow | pip | < 2.6.3 | 2.6.3 |
A Semantic Attack on Google Gemini - Read the Latest Research