https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 12 Nov 2026 21:11:41 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-84503 <p>A flaw was found in ansible-core&#39;s ansible.builtin.git module. The module invokes git (ls-remote, clone, fetch) with the repository URL as a positional argument and without a &#34;--&#34; separator, so a repository URL that begins with a dash is interpreted by git as a command-line option. A caller that passes an attacker-controlled repository URL to the module can trigger argument injection (for example --upload-pack/--exec), resulting in arbitrary command execution on the host running the module.</p> <p>A flaw was found in ansible-core&#39;s ansible.builtin.git module. The module invokes git (ls-remote, clone, fetch) with the repository URL as a positional argument and without a &#34;--&#34; separator, so a repository URL that begins with a dash is interpreted by git as a command-line option. A caller that passes an attacker-controlled repository URL to the module can trigger argument injection (for example --upload-pack/--exec), resulting in arbitrary command execution on the host running the module.</p> https://db.gcve.eu/vuln/fkie_cve-2026-84503 https://db.gcve.eu/vuln/ghsa-537w-5jw6-89cf <p>A flaw was found in ansible-core&#39;s ansible.builtin.git module. The module invokes git (ls-remote, clone, fetch) with the repository URL as a positional argument and without a &#34;--&#34; separator, so a repository URL that begins with a dash is interpreted by git as a command-line option. A caller that passes an attacker-controlled repository URL to the module can trigger argument injection (for example --upload-pack/--exec), resulting in arbitrary command execution on the host running the module.</p> <p>A flaw was found in ansible-core&#39;s ansible.builtin.git module. The module invokes git (ls-remote, clone, fetch) with the repository URL as a positional argument and without a &#34;--&#34; separator, so a repository URL that begins with a dash is interpreted by git as a command-line option. A caller that passes an attacker-controlled repository URL to the module can trigger argument injection (for example --upload-pack/--exec), resulting in arbitrary command execution on the host running the module.</p> https://db.gcve.eu/vuln/ghsa-537w-5jw6-89cf https://db.gcve.eu/vuln/opensuse-su-2026:12448-1 <p>ansible-core-2.21.6-1.1 on GA media</p> <p>ansible-core-2.21.6-1.1 on GA media</p> https://db.gcve.eu/vuln/opensuse-su-2026:12448-1 https://db.gcve.eu/vuln/ubuntu-cve-2026-84503 <p><strong>Affected:</strong> Ubuntu:22.04:LTS: ansible-core, Ubuntu:24.04:LTS: ansible-core, Ubuntu:26.10: ansible-core, Ubuntu:26.04:LTS: ansible-core</p> <p>A flaw was found in ansible-core&#39;s ansible.builtin.git module. The module invokes git (ls-remote, clone, fetch) with the repository URL as a positional argument and without a &#34;--&#34; separator, so a repository URL that begins with a dash is interpreted by git as a command-line option. A caller that passes an attacker-controlled repository URL to the module can trigger argument injection (for example --upload-pack/--exec), resulting in arbitrary command execution on the host running the module.</p> <p><strong>Affected:</strong> Ubuntu:22.04:LTS: ansible-core, Ubuntu:24.04:LTS: ansible-core, Ubuntu:26.10: ansible-core, Ubuntu:26.04:LTS: ansible-core</p> <p>A flaw was found in ansible-core&#39;s ansible.builtin.git module. The module invokes git (ls-remote, clone, fetch) with the repository URL as a positional argument and without a &#34;--&#34; separator, so a repository URL that begins with a dash is interpreted by git as a command-line option. A caller that passes an attacker-controlled repository URL to the module can trigger argument injection (for example --upload-pack/--exec), resulting in arbitrary command execution on the host running the module.</p> https://db.gcve.eu/vuln/ubuntu-cve-2026-84503