Homepage

Arbitrary Code Injection Affecting airflow-2-compat package, versions <2.11.2-r0

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.34% (26th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-MINIMOSLATEST-AIRFLOW2COMPAT-14173974
  • published4 Dec 2025
  • disclosed26 Nov 2025
Report a new vulnerability Found a mistake?

Introduced: 26 Nov 2025

CVE-2025-62593  (opens in a new tab)
CWE-94  (opens in a new tab)
CWE-352  (opens in a new tab)

How to fix?

Upgrade Minimos:latest airflow-2-compat to version 2.11.2-r0 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream airflow-2-compat package and not the airflow-2-compat package as distributed by Minimos. See How to fix? for Minimos:latest relevant fixed versions and status.

Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE vulnerability exploitable via Firefox and Safari. This vulnerability is due to an insufficient guard against browser-based attacks, as the current defense uses the User-Agent header starting with the string "Mozilla" as a defense mechanism. This defense is insufficient as the fetch specification allows the User-Agent header to be modified. Combined with a DNS rebinding attack against the browser, and this vulnerability is exploitable against a developer running Ray who inadvertently visits a malicious website, or is served a malicious advertisement (malvertising). This issue has been patched in version 2.52.0.