Threats affecting pkg:brew/bbot

CVE-2026-11332 is a vulnerability in ansible-core's ansible-galaxy role install command that allows a malicious role author to inject arbitrary git configuration flags via the src field in a role's meta/requirements.yml file. This improper neutralization of argument delimiters can lead to arbitrary code execution on the machine of a user who installs the malicious role. Exploitation requires user interaction by tricking a user into installing a crafted role. The vulnerability affects ansible-core versions from 1.0.5.1665 up to but not including 3.0.0. A fix is available in version 3.0.0.

Multiple vulnerabilities in bbot's unarchive.py module allow a malicious webserver to cause arbitrary file writes, leading to remote code execution (RCE) on the scanning user's system. This affects bbot versions from 1.0.5.1665 up to but not including 2.7.0. The issue is critical due to the potential for complete system compromise. A fix is available in version 2.7.0.

bbot's gitdumper.py component insufficiently sanitizes the .git/config and .git/index files, allowing a maliciously crafted repository to trigger arbitrary file writes and remote code execution (RCE) on the scanning user's system. This vulnerability affects bbot versions from 1.0.5.1665 up to but not including 2.7.0. A patch is available in version 2.7.0 to address this critical security flaw.

CVE-2024-9902 is a vulnerability in the ansible-core user module that allows an unprivileged user to create or replace files on any system path and take ownership when a privileged user runs the module against the unprivileged user's home directory. This can lead to unauthorized file modification and ownership changes if directory traversal permissions are present. The issue affects versions from 1.0.5.1665 up to but not including 2.1.2_1 and has been assigned a CVSS score of 6.3 (medium severity). A fix is available in version 2.1.2_1.

Ansible contains a vulnerability where sensitive information stored in Ansible Vault files can be exposed in plaintext during playbook execution if the no_log: true parameter is not set when loading vaulted variables. This can lead to unintentional disclosure of secrets such as passwords or API keys. The issue affects versions from 1.0.5.1665 up to but not including 2.4.0. A fix is available in version 2.4.0.

Ansible-Core contains a vulnerability (CVE-2024-11079) that allows attackers to bypass unsafe content protections by exploiting the hostvars object to reference and execute templated content. This flaw can lead to arbitrary code execution if remote data or module outputs are improperly templated within playbooks. The issue affects versions from 1.0.5.1665 up to but not including 2.4.0. A fix is available in version 2.4.0 and later.

An information disclosure vulnerability (CVE-2024-0690) exists in ansible-core where the ANSIBLE_NO_LOG configuration is not respected in certain tasks, such as loop items. This flaw can cause sensitive information, including decrypted secret values, to be exposed in output. The issue affects versions from 1.0.5.1665 up to but not including 1.1.5. A fix is available in version 1.1.5.