Apache Airflow versions from 3.0.0 up to but not including 3.0.5 contain a command injection vulnerability in the example DAG named "example_dag_decorator." This vulnerability arises from a non-validated parameter that allows a UI user to redirect the example to a malicious server and execute code on the worker. Exploitation requires that example DAGs are enabled in production (which is not the default) or that the example DAG code is copied to create a similar DAG. The issue is fixed in version 3.0.5.