CVE-2025-54415: Apache Airflow dag-factory RCE Vulnerability

CVE-2025-54415 Overview

A critical command injection vulnerability has been identified in dag-factory, a library for Apache Airflow® that enables declarative DAG (Directed Acyclic Graph) construction via configuration files. The vulnerability exists in the cicd.yml workflow within the astronomer/dag-factory GitHub repository. When triggered by pull_request_target events, the workflow is susceptible to exploitation, allowing attackers to execute arbitrary code within the GitHub Actions runner environment.

This misconfiguration enables malicious actors to establish reverse shells, exfiltrate sensitive secrets including the highly-privileged GITHUB_TOKEN, and ultimately gain full control over the repository. The vulnerability represents a significant supply chain risk as compromised repositories can be leveraged to distribute malicious code to downstream users.

Critical Impact

Attackers can achieve arbitrary code execution in the GitHub Actions runner, exfiltrate sensitive secrets including GITHUB_TOKEN, and gain full control over the dag-factory repository, potentially compromising the entire software supply chain.

Affected Products

• dag-factory versions 0.23.0a8 and below
• astronomer/dag-factory GitHub repository CI/CD workflows

Discovery Timeline

• 2025-07-26 - CVE-2025-54415 published to NVD
• 2025-07-29 - Last updated in NVD database

Technical Details for CVE-2025-54415

Vulnerability Analysis

This vulnerability falls under CWE-78 (Improper Neutralization of Special Elements used in an OS Command), commonly known as OS Command Injection. The flaw resides in the GitHub Actions workflow configuration file cicd.yml within the dag-factory repository.

The pull_request_target trigger in GitHub Actions runs in the context of the base repository rather than the fork, providing access to repository secrets and write permissions. When improperly configured, this trigger can allow code from untrusted pull requests to be executed with elevated privileges.

An attacker can exploit this vulnerability by submitting a malicious pull request that manipulates the workflow execution. Since the workflow runs with access to the repository's GITHUB_TOKEN and potentially other secrets, successful exploitation grants the attacker significant control over the repository infrastructure.

Root Cause

The root cause stems from insecure GitHub Actions workflow configuration. The pull_request_target trigger was designed to allow workflows to have write access to the target repository, but when combined with checkouts of untrusted code from the pull request head or execution of commands derived from pull request content, it creates an injection vector.

The workflow failed to properly sanitize or isolate execution of code from external contributors, allowing malicious payloads submitted via pull requests to execute within the trusted runner environment with access to sensitive secrets.

Attack Vector

The attack leverages the network-accessible nature of GitHub's pull request functionality. An attacker can:

1. Fork the dag-factory repository
2. Modify workflow-related files or code that gets executed during CI/CD
3. Submit a pull request to the upstream repository
4. The pull_request_target workflow executes with access to repository secrets
5. Malicious code executes, potentially establishing a reverse shell or exfiltrating the GITHUB_TOKEN

With the compromised GITHUB_TOKEN, attackers can push malicious commits, create releases, modify repository settings, or access other secrets stored in the repository.

The vulnerability does not require any user interaction beyond the normal pull request review process, and exploitation can occur before maintainers have an opportunity to review the malicious code.

Detection Methods for CVE-2025-54415

Indicators of Compromise

• Unexpected or unauthorized commits in the dag-factory repository history
• Suspicious GitHub Actions workflow runs, particularly those initiated by external pull requests
• Unusual network connections from GitHub Actions runners (reverse shell indicators)
• Unexpected changes to repository secrets or permissions
• New or modified workflow files with obfuscated or suspicious commands

Detection Strategies

• Monitor GitHub Actions audit logs for workflow runs triggered by pull_request_target events from external contributors
• Review GitHub Actions runner logs for unusual command executions or network connections
• Implement repository rulesets to require approval for workflow runs from first-time contributors
• Enable GitHub's secret scanning and push protection features
• Configure alerts for changes to workflow files in the .github/workflows/ directory

Monitoring Recommendations

• Enable GitHub Advanced Security features including code scanning and secret scanning
• Configure SIEM integration with GitHub audit logs to detect anomalous CI/CD activity
• Set up notifications for any modifications to workflow configuration files
• Regularly audit repository access permissions and review recent workflow executions
• Monitor for unauthorized releases or package publications

How to Mitigate CVE-2025-54415

Immediate Actions Required

• Upgrade dag-factory to version 0.23.0a9 or later immediately
• Review recent pull requests and workflow runs for signs of exploitation
• Rotate any secrets that may have been exposed, including the GITHUB_TOKEN
• Audit repository commit history for unauthorized changes
• Enable required approvals for workflow runs from external contributors

Patch Information

The vulnerability has been fixed in dag-factory version 0.23.0a9. The fix is documented in GitHub Security Advisory GHSA-g5hx-xv45-9whg. The specific fix was implemented in commit 751c0e5.

Additional context is available in Pull Request #460 and Pull Request #466.

Organizations using dag-factory should immediately update to the patched version and review their GitHub Actions workflow configurations for similar vulnerabilities.

Workarounds

• Restrict workflow permissions using the permissions key to grant only necessary access
• Configure pull_request_target workflows to avoid checking out or executing untrusted code from pull request heads
• Enable GitHub's "Require approval for first-time contributors" setting for Actions
• Use environment protection rules to require manual approval for sensitive workflow jobs
• Consider using pull_request trigger instead of pull_request_target where elevated permissions are not required

# Example: Review and update dag-factory version
pip install --upgrade dag-factory>=0.23.0a9

# Verify installed version
pip show dag-factory | grep Version