CVE-2022-46421 Apache Airflow Hive Provider: Hive Provider RCE vulnerability with hive_cli_params

Critical 9.8 Published 20 Dec 2022 Updated 16 Apr 2025

Attackers can execute arbitrary commands via improper neutralization in the Apache Airflow Hive Provider, requiring an upgrade to mitigate.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-46421?

CVE-2022-46421 is a critical command injection vulnerability in Apache Airflow Hive Provider, published on 20 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow Hive Provider.This issue affects Apache Airflow Hive Provider: before 5.0.0.

Weakness: CWE-77

Which versions are affected by CVE-2022-46421?

3 open source packages ship an affected version, including apache-airflow-providers-apache-hive. It affects 1 product.

Package	Affected	Fixed in
`apache-airflow-providers-apache-hive` PyPI	All versions	`5.0.0`
`apache-airflow-providers-apache-hive` PyPI	All versions	`5.0.0`
`apache-airflow-providers-apache-hive` PyPI	All versions	`5.0.0`

Products include Apache Apache-Airflow-Providers-Apache-Hive.

How do I fix CVE-2022-46421?

Upgrade apache-airflow-providers-apache-hive to 5.0.0 or later.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2022-46421 being exploited?

There is no known exploitation of CVE-2022-46421 in the wild and no public exploit code.

Sources

Also known as GHSA-rc58-qr9j-cpgw, PYSEC-2026-274.