Remote Code Execution Vulnerability in dag-factory Library for Apache Airflow
CVE-2025-54415

9.1CRITICAL

Key Information:

Vendor

Astronomer

Status
Dag-factory
Vendor
CVE Published:
26 July 2025

What is CVE-2025-54415?

A vulnerability exists in the dag-factory library for Apache Airflow that enables attackers to exploit the cicd.yml workflow. When triggered by pull_request_target, the misconfiguration allows unauthorized code execution within the GitHub Actions runner environment. This could lead to a full compromise of the affected repository as attackers may establish a reverse shell and exfiltrate sensitive data, including access tokens. Users are advised to upgrade to version 0.23.0a9 or later to mitigate this risk.

Affected Version(s)

dag-factory < 0.23.0a9

References

https://github.com/astronomer/dag-factory/security/adviso...
x_refsource_CONFIRM
https://github.com/astronomer/dag-factory/pull/460
x_refsource_MISC
https://github.com/astronomer/dag-factory/pull/466
x_refsource_MISC

CVSS V4

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-54415 : Remote Code Execution Vulnerability in dag-factory Library for Apache Airflow