The flaw resides in Ansible‑Core’s ansible.builtin.git module, which starts the git command with the repository URL as a positional argument and omits the mandatory "--" separator. If the URL supplied by a caller begins with a dash, git interprets it as an option rather than a path, enabling an attacker to inject arbitrary git options such as --exec or --upload-pack. Execution of these options can reflect to arbitrary shell commands on the host running the playbook, thereby giving the attacker remote code execution capabilities through the ansible.builtin.git module. This type of vulnerability is classified as CWE‑88.

Red Hat customers using product families that embed ansible-core are affected, including Migration Toolkit for Applications 8 and Migration Toolkit for Virtualization, OpenShift Service Mesh 3, Red Hat Advanced Cluster Management for Kubernetes 2. The Ansible Automation Platform 2 series, Ansible Core 2, OpenShift Container Platform 4 and 5, OpenStack Platform 17.1 and 18.0, and a wide range of Red Hat Enterprise Linux releases from 8 to 10 are all impacted. The list extends to auxiliary services such as the Discovery 2 portal, Self‑service Automation Portal 2, and Service Telemetry Framework 1.5.

The publicly available CVSS score of 6.7 indicates a moderate severity overall. Because the vulnerability requires the attacker to supply a specially crafted repository URL, the exploitation vector is typically through playbooks authored or controlled by the attacker or whose execution context the attacker can influence. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed public exploitation yet. Nevertheless, the potential for arbitrary command execution on any host that runs the vulnerable module mandates prompt remediation.