A flaw was found in ansible-runner. The default temporary files configuration in ansible-2.0.0 is written to world rw location. An attacker can pre-create that directory, which may allow them to either read potentially private information or force ansible-runner to write files as the legitimate user in a place they did not expect.

Upstream issue:

https://github.com/ansible/ansible-runner/issues/738

Upstream patch:

https://github.com/ansible/ansible-runner/pull/742/commits/60b059f00409224acae1e417153a241c8591ad89