-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper input validation in the parse_json function when handling remote data. The patch introduced a 'from_remote' flag and added _clean_data/_clean_data_struct to sanitize template tags. Before the fix, parse_json did not sanitize inputs from untrusted sources, allowing Jinja2 template injection. The functions calling parse_json (e.g., in script.py, runner modules) were vulnerable because they passed remote data to parse_json without sanitization. The core issue resides in parse_json's lack of input filtering prior to the patch.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ansible | pip | < 1.6.6 | 1.6.6 |