-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ansible-runner | pip | >= 2.0.0, < 2.1.0 | 2.1.0 |
PythonPythonMiggo AIRoot Cause AnalysisThe vulnerability stems from insecure temporary directory handling. The pre-patch code in StreamWorker's init method used tempfile.TemporaryDirectory().name, which creates a directory that is immediately deleted when the TemporaryDirectory object is garbage collected. This created a race condition window where an attacker could replace the directory. The fix in commit 93e95a3 replaced this with mkdtemp() (which creates persistent unique directories) and removed the unsafe cleanup pattern. The GitHub PR #742/commits explicitly references this race condition fix in the StreamWorker initialization logic.
Ongoing coverage of React2Shell