CRITICALCVSS 9.8EPSS 3.3%

CVE-2022-46421

Apache Airflow Hive Provider vulnerable to Command Injection

Published: 2022-12-20
Modified: 2026-10-26
EPSS percentile: 88%
Aliases: GHSA-rc58-qr9j-cpgw
Sources: github-advisory

Summary

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow Hive Provider.This issue affects Apache Airflow Hive Provider before 5.0.0.

Affected packages

Ecosystem	Package	Affected versions	Fixed versions
PyPI	apache-airflow-providers-apache-hive	—	5.0.0

Remediation: Upgrade to 5.0.0 or later.

References

https://github.com/advisories/GHSA-rc58-qr9j-cpgw

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.

EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.