CVE-2026-84503: Ansible-core: ansible-core: ansible.builtin.git invokes git without a `--` separator, allowing argument injection via a `-`-leading repository url (e.g. --upload-pack) -> rce
A flaw was found in ansible-core's ansible.builtin.git module. The module invokes git (ls-remote, clone, fetch) with the repository URL as a positional argument and without a "--" separator, so a repository URL that begins with a dash is interpreted by git as a command-line option. A caller that passes an attacker-controlled repository URL to the module can trigger argument injection (for example --upload-pack/--exec), resulting in arbitrary command execution on the host running the module.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Hosts running the ansible.builtin.git module are exposed when the repository URL supplied to the module is attacker-controlled. The resulting command execution occurs on the host running the module.
What does an attacker need to exploit it?
An attacker needs influence over the repository URL passed to ansible.builtin.git and must cause it to begin with a dash. Such a value can be interpreted by git as an option, including options such as --upload-pack or --exec.
Are ordinary repository URLs affected?
The described injection requires a repository URL beginning with a dash. Repository URLs that do not begin with a dash are not described as triggering this argument-injection condition.
What can be done while a patch is unavailable?
Do not pass untrusted repository URLs to ansible.builtin.git. Validate or constrain repository URL inputs so they cannot start with a dash.