pypi package report

Is apache-airflow-providers-mongo safe?

1 known vulnerability, worst severity CRITICAL.

// reach

4 direct dependencies

3 carry known advisories, worst CRITICAL

3 packages depend on it

an advisory here reaches each of them

Create a free accountfor every dependency path, dependent and what to upgrade
// ai model usage

No published models are known to use this package.

cvss
9.1
critical

CVSS v3.1 base score out of 10

epss
0.63%
medium

chance of exploitation in 30 days, 50th percentile of all CVEs

xyz score
4.6
medium

CyberXYZ composite out of 10

fig. 01 — GHSA-x5pm-h33q-cjrw, the advisory selected below

// 1 advisories

GHSA-x5pm-h33q-cjrw

CRITICALGitHub ratingCVE-2024-25141

When ssl was enabled for Mongo Hook, default settings included "allow_insecure" which caused that certificates were not validated. This was unexpected and undocumented. Users are recommended to upgrade to version 4.0.0, which fixes this issue.

// cvss v3.1 vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Checked 2026-11-06 at 21:55 UTC. The most recent advisory here was published 2024-02-20. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Think a verdict here is wrong? Tell us — we respond within 2 business days.