{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/airflow-3.0.5-through-3.3.x/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-101031"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Airflow (3.0.5 through 3.3.x)"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Apache"],"content_html":"\u003cp\u003eThe \u003ccode\u003eexample_dag_decorator\u003c/code\u003e example DAG shipped with Apache Airflow validates an IP address using Python's \u003ccode\u003eipaddress\u003c/code\u003e module and passes it into a shell command. Because \u003ccode\u003eipaddress\u003c/code\u003e accepts IPv6 zone identifiers containing arbitrary characters, a user who can trigger the DAG when example DAGs are enabled can facilitate shell command injection.\u003c/p\u003e\n","date_modified":"2026-11-09T09:13:48Z","date_published":"2026-11-09T09:13:48Z","id":"https://feed.craftedsignal.io/briefs/2026-11-airflow-shell-injection/","summary":"The `example_dag_decorator` DAG in Apache Airflow versions 3.0.5 through 3.3.x is vulnerable to shell command injection via IPv6 zone identifiers when example DAGs are enabled.","title":"Apache Airflow: Shell command injection in example_dag_decorator (CVE-2026-101031)","url":"https://feed.craftedsignal.io/briefs/2026-11-airflow-shell-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Airflow (3.0.5 Through 3.3.x)","version":"https://jsonfeed.org/version/1.1"}