CVE-2022-40189 json
Apache Airlfow Pig Provider RCE
published 3y ago modified 14d ago also BIT-airflow-2022-40189 , EUVD-2022-7427 , GHSA-rmf2-pwfq-h75j , PYSEC-2026-270
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 4.2%
- EPSS 4.2% chance of exploitation in 30 days, percentile 90%
- public exploits
- 0
- none known
Summary
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Pig Provider, Apache Airflow allows an attacker to control commands executed in the task execution context, without write access to DAG files. This issue affects Pig Provider versions prior to 4.0.0. It also impacts any Apache Airflow versions prior to 2.3.0 in case Pig Provider is installed (Pig Provider 4.0.0 can only be installed for Airflow 2.3.0+). Note that you need to manually install the Pig Provider version 4.0.0 in order to get rid of the vulnerability on top of Airflow 2.3.0+ version.
Patch / fix
- pypi apache-airflow 2.3.0
- bitnami airflow 2.3.0
- Apache Software Foundation Apache Airlfow Pig Provider 4.0.0
- Apache Software Foundation Apache Airflow 2.3.0
- github.com/apache/airflow#27644 pull request
Is CVE-2022-40189 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- last yr.
Exploit prediction
4.16% chance of exploitation in the next 30 days, higher than 90% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| OSV | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | apache-airflow | <2.3.0 |
2.3.0 |
| bitnami | airflow | <2.3.0 |
2.3.0 |
Affected products
- Apache Software Foundation Apache Airlfow Pig Provider
- Apache Software Foundation Apache Airflow
Classification
- Weakness
-
- CWE-78 Improper Neutralization of Special Elements used in an OS Command
References
-
github.com
/apache/airflow/pull/27644
web, patch, third-party-advisory, advisory
-
lists.apache.org
/thread/yxnfzfw2w9pj5s785k3rlyly4y44sd15
web, mailing-list, third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-40189
advisory, web
-
github.com
/apache/airflow
package
-
github.com
/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2026-270.yaml
web
-
pypi.org
/project/apache-airflow
web, package
-
github.com
/advisories/GHSA-rmf2-pwfq-h75j
advisory
Sources
- CVE List CVE-2022-40189
- GitHub Advisory GHSA-rmf2-pwfq-h75j
- NVD CVE-2022-40189
- OSV BIT-airflow-2022-40189
- OSV PYSEC-2026-270
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.