-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper shell escaping when constructing subprocess commands. The commit diff shows critical fixes in Runner.run() where shell=True was removed and command strings were replaced with list-based arguments. Similarly, DocConfig.prepare_plugin_docs_command previously used string concatenation for plugin names, creating injection risks when combined with shell=True. Both functions directly handled untrusted input in a way that enabled shell command injection prior to patching.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ansible-runner | pip | < 2.1.0 | 2.1.0 |