Launchpad.net

CVE 2019-0216

A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views.

See the CVE page on Mitre.org for more details.