Technical impact
A flaw in ansible-core allows a malicious role author to inject arbitrary git configuration flags through the src field of a dependency specification in meta/requirements.yml. The improper neutralization of argument delimiters enables the attacker to execute commands on the machine that runs ansible-galaxy role install. This injection exposes the system to arbitrary code execution and is classified as a CWE‑88 vulnerability.
Affected Systems
The vulnerability impacts Red Hat Ansible Automation Platform 2, specifically the ansible-core component. No detailed version information is provided, so any installation that relies on the vulnerable ansible‑core logic remains a risk until an official fix is released.
Risk and Exploitability
The CVSS score of 7.8 indicates a high severity, and the EPSS score is not available, making it unclear how frequently the flaw is exploited. The issue is not listed in the CISA KEV catalog. The attack requires a role author with malicious intent to supply a crafted meta/requirements.yml; a user who installs that role using ansible‑galaxy role install will trigger the code execution. The vulnerability’s exploitation is limited to the environment where the role is installed, but it can compromise any user or system that runs the install command. Red Hat has indicated that no workaround meeting its product security criteria is available.
Github GHSA