Code Execution Vulnerability in Apache Airflow Documentation for Example XCom

CVE-2025-54550

What is CVE-2025-54550?

The Apache Airflow documentation included a flawed example, example_xcom, which demonstrated an unsafe pattern for reading values from XCom. This misconfiguration could potentially allow trusted UI users to exploit the implementation, leading to arbitrary code execution on the worker. Although not intended for production environments, the example's replication could place users at risk. It is crucial for users who have followed this pattern to review and improve their implementations. Apache Airflow version 3.2.0 addresses this issue with an enhanced example.

References