AIKIDO-2026-215161

TL;DR

Affected versions of ansible-core are vulnerable to command injection in the ansible-galaxy role install command due to improper neutralization of argument delimiters in role dependency specifications. A malicious role can inject arbitrary Git configuration options through the src field in meta/requirements.yml, potentially leading to arbitrary code execution on systems that install the role.