Apache Airflow's scheduler deserializes XCom values written by task code when evaluating task dependencies. This behavior allows a Dag author, who controls XCom data, to influence the scheduler's deserialization process, which is intended to be restricted to code installed by the Deployment Manager. This can lead to privilege escalation in deployments where Dag authors are less trusted than Deployment Managers. The issue is addressed in Apache Airflow version 3.4.0 and later by restricting dependency evaluation to primitive XCom values.