PYSEC-2026-1122: Ansible: template injection

Published Dec 12, 2023

Updated

A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data. This issue could allow an attacker to use a specially crafted file to introduce templating injection when supplying templating data.

Affected Software

1 affected component

Ansible Ansible

Event History

Dec 12, 2023

CVE Published

via OSV·10:01 PM

Data Sourced

via OSV·10:01 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The vulnerability is rated with local attack vector and low privileges required. No user interaction is required, but the attacker must be able to provide specially crafted file content used as templating data.

Which Ansible deployments are most exposed?

Ansible controllers that perform internal templating on data originating from untrusted or lower-privileged users are the relevant exposure point. The issue occurs when internal templating operations remove the unsafe designation from that data.

PYSEC-2026-1122: Ansible: template injection

Affected Software

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which Ansible deployments are most exposed?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which Ansible deployments are most exposed?