https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 14:44:16 +0000 https://cve.radiocsirt.org/vuln/alsa-2026:57148 <p><strong>Affected:</strong> AlmaLinux:10: ansible-core, AlmaLinux:10: ansible-test</p> <p>Ansible is a radically simple model-driven configuration management, multi-node deployment, and remote task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically.</p> <p>Security Fix(es):</p> <p>* ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution (CVE-2026-11332)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:10: ansible-core, AlmaLinux:10: ansible-test</p> <p>Ansible is a radically simple model-driven configuration management, multi-node deployment, and remote task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically.</p> <p>Security Fix(es):</p> <p>* ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution (CVE-2026-11332)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2026:57148 https://cve.radiocsirt.org/vuln/brew-ansible-cve-2026-11332 <p><strong>Affected:</strong> Homebrew: ansible</p> <p>A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role&#39;s meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field. This allows arbitrary code execution on the machine of a user who installs the role via ansible-galaxy role install.</p> <p><strong>Affected:</strong> Homebrew: ansible</p> <p>A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role&#39;s meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field. This allows arbitrary code execution on the machine of a user who installs the role via ansible-galaxy role install.</p> https://cve.radiocsirt.org/vuln/brew-ansible-cve-2026-11332 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0737 certfr-2026-avi-0737 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0737 https://cve.radiocsirt.org/vuln/euvd-2026-368446 EUVD-2026-368446 https://cve.radiocsirt.org/vuln/euvd-2026-368446 https://cve.radiocsirt.org/vuln/fkie_cve-2026-11332 <p>A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role&#39;s meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field. This allows arbitrary code execution on the machine of a user who installs the role via ansible-galaxy role install.</p> <p>A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role&#39;s meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field. This allows arbitrary code execution on the machine of a user who installs the role via ansible-galaxy role install.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-11332 https://cve.radiocsirt.org/vuln/ghsa-w8p5-mx5w-cpqj <p><strong>Affected:</strong> PyPI: ansible-core</p> <p>A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role&#39;s meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field. This allows arbitrary code execution on the machine of a user who installs the role via ansible-galaxy role install.</p> <p><strong>Affected:</strong> PyPI: ansible-core</p> <p>A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role&#39;s meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field. This allows arbitrary code execution on the machine of a user who installs the role via ansible-galaxy role install.</p> https://cve.radiocsirt.org/vuln/ghsa-w8p5-mx5w-cpqj https://cve.radiocsirt.org/vuln/msrc_cve-2026-11332 msrc_CVE-2026-11332 https://cve.radiocsirt.org/vuln/msrc_cve-2026-11332 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11007-1 <p>ansible-core-2.21.0-3.1 on GA media</p> <p>ansible-core-2.21.0-3.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11007-1 https://cve.radiocsirt.org/vuln/pysec-2026-3458 <p><strong>Affected:</strong> PyPI: ansible-core</p> <p>A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role&#39;s meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field. This allows arbitrary code execution on the machine of a user who installs the role via ansible-galaxy role install.</p> <p><strong>Affected:</strong> PyPI: ansible-core</p> <p>A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role&#39;s meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field. This allows arbitrary code execution on the machine of a user who installs the role via ansible-galaxy role install.</p> https://cve.radiocsirt.org/vuln/pysec-2026-3458 https://cve.radiocsirt.org/vuln/rhsa-2026:42078 <p>lodash: lodash: Arbitrary code execution via untrusted input in template imports fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies fast-uri: fast-uri: URI authority bypass due to improper delimiter handling python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution aap-gateway: missing requestHeadersToRemove allows mTLS bypass via Subject header spoofing pulpcore: pulpcore: relative_path_validator bypass via directory traversal in FilesystemExport golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget GitPython: GitPython: Arbitrary command execution due to bypass of dangerous Git option checks GitPython: GitPython: Arbitrary code execution via improper validation of clone options GitPython: GitPython: Arbitrary code execution via injected newlines in Git configuration…</p> <p>lodash: lodash: Arbitrary code execution via untrusted input in template imports fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies fast-uri: fast-uri: URI authority bypass due to improper delimiter handling python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution aap-gateway: missing requestHeadersToRemove allows mTLS bypass via Subject header spoofing pulpcore: pulpcore: relative_path_validator bypass via directory traversal in FilesystemExport golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget GitPython: GitPython: Arbitrary command execution due to bypass of dangerous Git option checks GitPython: GitPython: Arbitrary code execution via improper validation of clone options GitPython: GitPython: Arbitrary code execution via injected newlines in Git configuration…</p> https://cve.radiocsirt.org/vuln/rhsa-2026:42078 https://cve.radiocsirt.org/vuln/rlsa-2026:57148 <p><strong>Affected:</strong> Rocky Linux:10: ansible-core</p> <p>Ansible is a radically simple model-driven configuration management, multi-node deployment, and remote task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically.</p> <p>Security Fix(es):</p> <p>* ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution (CVE-2026-11332)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> Rocky Linux:10: ansible-core</p> <p>Ansible is a radically simple model-driven configuration management, multi-node deployment, and remote task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically.</p> <p>Security Fix(es):</p> <p>* ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution (CVE-2026-11332)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/rlsa-2026:57148 https://cve.radiocsirt.org/vuln/suse-su-2026:22171-1 <p>Security update for ansible-core</p> <p>Security update for ansible-core</p> https://cve.radiocsirt.org/vuln/suse-su-2026:22171-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-11332 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: ansible, Ubuntu:Pro:16.04:LTS: ansible, Ubuntu:Pro:18.04:LTS: ansible, Ubuntu:Pro:20.04:LTS: ansible, Ubuntu:22.04:LTS: ansible-core, Ubuntu:Pro:22.04:LTS: ansible, Ubuntu:24.04:LTS: ansible, Ubuntu:24.04:LTS: ansible-core, Ubuntu:25.10: ansible, Ubuntu:25.10: ansible-core and 2 more</p> <p>A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role&#39;s meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field. This allows arbitrary code execution on the machine of a user who installs the role via ansible-galaxy role install.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: ansible, Ubuntu:Pro:16.04:LTS: ansible, Ubuntu:Pro:18.04:LTS: ansible, Ubuntu:Pro:20.04:LTS: ansible, Ubuntu:22.04:LTS: ansible-core, Ubuntu:Pro:22.04:LTS: ansible, Ubuntu:24.04:LTS: ansible, Ubuntu:24.04:LTS: ansible-core, Ubuntu:25.10: ansible, Ubuntu:25.10: ansible-core and 2 more</p> <p>A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role&#39;s meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field. This allows arbitrary code execution on the machine of a user who installs the role via ansible-galaxy role install.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-11332 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2657 <p>Ein lokaler Angreifer kann eine Schwachstelle in Red Hat Ansible Automation Platform ausnutzen, um beliebigen Programmcode auszuführen.</p> <p>Ein lokaler Angreifer kann eine Schwachstelle in Red Hat Ansible Automation Platform ausnutzen, um beliebigen Programmcode auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2657