plugins/cache/memcached.py documents "JSON formatted" records (line 13) but imports neither json nor pickle and does no explicit (de)serialization. set() passes the Ansible facts dict directly to python-memcached with mincompresslen=1 (lines 214-217); get() returns the client result unchanged (lines 201-212). python-memcached auto-pickles non-str/int values (FLAGPICKLE) and, with mincompresslen set, compresses them (FLAGCOMPRESSED) -> stored flags 9, and calls pickle.loads() on read. The sibling plugins/cache/redis.py uses explicit AnsibleJSONEncoder/Decoder (lines 189, 194). memcached has no authentication and the key is "ansiblefacts<host>" (default prefix, lines 31/193-194), so an attacker with network reach to the memcached instance can poison a fact-cache entry that the controller unpickles on the next read, yielding code execution as the ansible user. Upstream: https://github.com/ansible-collections/community.general plugins/cache/memcached.py — UNFIXED (no PR; no public CVE) Affected file: plugins/cache/memcached.py (:13 docstring, :201-217 get/set)