UpHeron
All vulnerabilities

Servers and applications

CVE-2023-47265

Apache Airflow, versions 2.6.0 through 2.7.3 has a stored XSS vulnerability that allows a DAG author to add an unbounded and not-sanitized javascript in the parameter description field of the DAG. This Javascript can be executed on the client side of any of the user who looks at the tasks in the browser sandbox. While this issue does not allow to exit the browser sandbox or manipulation of the…

Severity
Medium 5.4
Published
21 Dec 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
Apache AirflowServers and applications · cpe:a:apache:airflow
  • From 2.6.0 up to 2.7.3

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-47265
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-47265