-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ansible-core | pip | >= 2.18.0b1, < 2.18.1rc1 | 2.18.1rc1 |
| ansible-core | pip | >= 2.17.0b1, < 2.17.7rc1 | 2.17.7rc1 |
| ansible-core | pip | < 2.16.14rc1 | 2.16.14rc1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper handling of AnsibleUnsafe markers when variables are accessed via hostvars. The commit diff shows critical changes to AnsibleUndefined's attribute handling in native_helpers.py, where unsafe checks were added post-facto. The ansible_*_concat functions were modified to propagate unsafe flags, indicating they previously lacked proper validation. HostVars modifications expanded variable exposure scope. The security fix explicitly addresses unsafe context preservation through these components, matching the CWE-20 (Input Validation) classification.
A Semantic Attack on Google Gemini - Read the Latest Research