AIKIDO-2026-215161
ansible-core is vulnerable to Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
78
High Risk
This Affects:
ansible-coreTL;DR
Affected versions of ansible-core are vulnerable to command injection in the ansible-galaxy role install command due to improper neutralization of argument delimiters in role dependency specifications. A malicious role can inject arbitrary Git configuration options through the src field in meta/requirements.yml, potentially leading to arbitrary code execution on systems that install the role.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
ansible-core is vulnerable to Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') in versions 0.0.1 - 2.21.0.
How to fix this
Upgrade the ansible-core library to the patch version.
Links
github.com/ansible/ansible/blob/v2.21.1/changelogs/CHANGELOG-v2.21.rst#v2211
access.redhat.com/security/cve/CVE-2026-11332bugzilla.redhat.com/show_bug.cgi?id=2485379github.com/ansible/ansiblesecurity.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11332.json
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant