Apache Apache-Airflow-Providers-MySQL vulnerabilities

2 CVEs affecting Apache Apache-Airflow-Providers-MySQL, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-27018, published 2025-03-19.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-22884, published 2023-01-21. Critical severity, CVSS 9.8. EPSS: 11.1% chance of exploitation in the next 30 days. Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow, Apache Software Foundation Apache Airflow MySQL…
CVE-2025-27018, published 2025-03-19. Medium severity, CVSS 6.3. EPSS: 0.9% chance of exploitation in the next 30 days. Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Airflow MySQL Provider. When user triggered a DAG with dump_sql or load_sql functions…