RunAdHocCommand.build_args() incorrectly appends the limit value to the Ansible command line without sanitization. A string that begins with a hyphen is parsed as a new CLI option, so the attacker can inject short‑circuit flags such as --version or --help. The description notes that only these short‑circuit flags are usable right now, but if ansible-core changes its default pattern the attacker could insert other options, potentially affecting execution or revealing information.

Red Hat Ansible Automation Platform 2. The vulnerability is present in this product, but no additional sub‑version detail is provided in the entry.

The CVSS score of 3.1 reflects a low severity. EPSS information is not available, and the issue is not listed in CISA’s KEV catalog, suggesting that widespread exploitation has not yet occurred. The attack vector would involve exploiting the ad‑hoc command interface of the Automation Controller, which normally requires user or admin privileges. Because only very simple CLI options are currently exploitable, the immediate risk to confidentiality, integrity or availability remains low, but it could become more significant if the underlying Ansible parser changes.