Remote Code Execution (RCE)

ansible is vulnerable to remote code execution RCE. The pipe lookup plugin is set to shell=True by default when using subprocess.Popen, allowing to remote code execution through the overwriting of ansible facts due to the lack of sanitization of variables...

CVE-2020-1734

A flaw was found in the pipe lookup plugin of ansible. Arbitrary commands can be run, when the pipe lookup plugin uses subprocess.Popen with shell=True, by overwriting ansible facts and the variable is not escaped by quote plugin. An attacker could take advantage and run arbitrary commands by...