A flaw was found in ansible-core's ansible.builtin.git module. The module invokes git (ls-remote,...
Fix status by distribution
Records published by each distribution for this CVE. Fixed versions differ by release; check each link.
- Debian DEBIAN-CVE-2026-84503 ansible-core No fixed version in this record
- Ubuntu UBUNTU-CVE-2026-84503 ansible-core No fixed version in this record
Original description The description as published by the source.
A flaw was found in ansible-core's ansible.builtin.git module. The module
invokes git (ls-remote, clone, fetch) with the repository URL as a positional
argument and without a "--" separator, so a repository URL that begins with a
dash is interpreted by git as a command-line option. A caller that passes an
attacker-controlled repository URL to the module can trigger argument
injection (for example --upload-pack/--exec), resulting in arbitrary command
execution on the host running the module.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- web secalert@redhat.com
- web secalert@redhat.com
- web nvd.nist.gov
- web github.com
- web secalert@redhat.com
- web secalert@redhat.com