cve.bz

CVE-2025-27018

6.3 mediumEPSS 0.9%

Medium (6.3) in apache apache-airflow-providers-mysql. EPSS 0.9% chance of exploitation in the next 30 days. Fixed in apache-airflow-providers-mysql 6.2.0.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Airflow MySQL Provider. When user triggered a DAG with dump_sql or load_sql functions they could pass a table parameter from a UI, that could cause SQL injection by running SQL that was not intended. It could lead to data corruption, modification and others. This issue affects Apache Airflow MySQL Provider: before 6.2.0. Users are recommended to upgrade to version 6.2.0, which fixes the issue.

Severity

CVSS 3.1

6.3 medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS
0.9% chance of exploitation in the next 30 days; higher than 60% of CVEs (scores of 2026-10-31)
CWE
CWE-89
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-hhm6-jjf4-6pm3PyPIapache-airflow-providers-mysql<6.2.06.2.0
PYSEC-2026-1151PyPIapache-airflow-providers-mysql<6.2.06.2.0

References

Check your stackJSON