Threats tagged 'brew-bbot-cve-2026-11332'

CVE-2026-11332 is a vulnerability in ansible-core's ansible-galaxy role install command that allows a malicious role author to inject arbitrary git configuration flags via the src field in a role's meta/requirements.yml file. This improper neutralization of argument delimiters can lead to arbitrary code execution on the machine of a user who installs the malicious role. Exploitation requires user interaction by tricking a user into installing a crafted role. The vulnerability affects ansible-core versions from 1.0.5.1665 up to but not including 3.0.0. A fix is available in version 3.0.0.