The flaw lies in ansible‑core’s collection installation path where the _extract_collection_from_git() function constructs a git clone command without the mandatory '--' end‑of‑options separator. arguments, those arguments are interpreted by the shell and executed during the collection install. This results in arbitrary code execution with the privileges of the user running the ansible‑galaxy collection install command, effectively allowing the attacker to take full control of the target machine. The weakness is a classic example of command‑injection vulnerability (CWE‑88).

The affected products are Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 8, 9, 10, and Red Hat Satellite 6. Any installation that relies on the open‑source ansible‑core library without the patch is potentially vulnerable; the specific version is not listed, so verification of the ansible‑core iteration is required.

The CVSS score of 7.8 classifies the vulnerability as high severity, but the EPSS score of less than 1% indicates that exploitation attempts are rare in the wild. The flaw is not included in CISA’s KEV catalog. Attackers must provide a malicious collection source, typically via a requirements.yml file or by directly invoking ansible‑galaxy collection install with a crafted URL. This can occur if a system pulls untrusted repositories or a trusted user executes the install command with a malicious source. The lack of a secure separator permits arbitrary parameters to be passed to the underlying shell, leading to command execution.