Description
Multiple argument injection vulnerabilities in Ansible before 1.6.7 allow remote attackers to execute arbitrary code by leveraging access to an Ansible managed host and providing a crafted fact, as demonstrated by a fact with (1) a trailing " src=" clause, (2) a trailing " temp=" clause, or (3) a trailing " validate=" clause accompanied by a shell command.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ansible | 1.6.8+dfsg-1 | — |
| Debian 13 | ansible | 1.6.8+dfsg-1 | — |
| Debian 12 | ansible | 1.6.8+dfsg-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 14.04 LTS | ansible | 1.5.4+dfsg-1ubuntu0.1~esm2 | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | ansible | 2.2.0.0-1.1 | openSUSE-SU-2024:10326-1 |
| openSUSE Tumbleweed | ansible-10 | 10.6.0-1.1 | openSUSE-SU-2024:14536-1 |
| openSUSE Tumbleweed | ansible-11 | 11.11.0-1.1 | openSUSE-SU-2025:15605-1 |
| openSUSE Tumbleweed | ansible-12 | 12.2.0-1.1 | openSUSE-SU-2025:15753-1 |
| openSUSE Tumbleweed | ansible-13 | 13.7.0-1.1 | openSUSE-SU-2026:10944-1 |
| openSUSE Tumbleweed | ansible-14 | 14.6.0-1.1 | openSUSE-SU-2026:12447-1 |
| openSUSE Tumbleweed | ansible-9 | 9.8.0-1.1 | openSUSE-SU-2024:14244-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | ansible | < 1.6.7 | 1.6.7 | GHSA-64cw-m57j-65xj |
Advisories 7
- openSUSE-SU-2026:12447-1 ansible-14-14.6.0-1.1 on GA media SUSE / openSUSE Security Updates · Nov 7, 2026
- openSUSE-SU-2026:10944-1 ansible-13-13.7.0-1.1 on GA media SUSE / openSUSE Security Updates · Jun 4, 2026
- openSUSE-SU-2025:15605-1 ansible-11-11.11.0-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15753-1 ansible-12-12.2.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10326-1 ansible-2.2.0.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14536-1 ansible-10-10.6.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14244-1 ansible-9-9.8.0-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025