CVE-2026-84503
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
18/100
Published: 2026-11-09
Modified: 2026-11-13
First seen: 2026-11-09
Status: active
Attack Surface
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Local
AC:
High
PR:
Low
UI:
Required
S:
Unchanged
C:
High
I:
High
A:
High
Description
A flaw was found in ansible-core's ansible.builtin.git module. The module invokes git (ls-remote, clone, fetch) with the repository URL as a positional argument and without a "--" separator, so a repository URL that begins with a dash is interpreted by git as a command-line option. A caller that passes an attacker-controlled repository URL to the module can trigger argument injection (for example --upload-pack/--exec), resulting in arbitrary command execution on the host running the module.
Weakness Classification (1)
References & Advisories (4)
vendor-advisory
x_refsource_REDHAT
vendor-advisory
x_refsource_REDHAT