Threats tagged 'ghsa-v5m9-m7pg-q8f3'

A command injection vulnerability exists in apache-airflow-providers-ssh versions before 7.0.1 in the SSHRemoteJobOperator. The operator incorrectly quotes environment parameter values only once, allowing shell syntax like $(...) to be executed on the remote SSH host. This enables a user who can trigger a DAG but cannot author DAGs to execute arbitrary commands on the remote host as the SSH user. Upgrading to version 7.0.1 or later mitigates this issue.