Read the docs
TI-2014-04077 Aliases CVE-2014-4967GHSA-64cw-m57j-65xj

Multiple argument injection vulnerabilities in Ansible before 1.6.7 allow remote…

Priority MEDIUM 48CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

Multiple argument injection vulnerabilities in Ansible before 1.6.7 allow remote attackers to execute arbitrary code by leveraging access to an Ansible managed host and providing a crafted fact, as demonstrated by a fact with (1) a trailing " src=" clause, (2) a trailing " temp=" clause, or (3) a trailing " validate=" clause accompanied by a shell command.

Why it matters now

EPSS 0.03521 89th percentileScored 2026-11-07
Fix Fixed ansible (PyPI): 1.6.7

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—ansible (PyPI)before 1.6.71.6.7Patch availableGHSA-64cw-m57j-65xj
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • ansible (PyPI) Vendor— Affected before 1.6.7 Fixed in 1.6.7 Patch available GHSA-64cw-m57j-65xj

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*before 1.6.7VulnerableRed Hat
  • cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:* Versions before 1.6.7 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-64cw-m57j-65xj ansible (PyPI) Fixed in 1.6.7 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2014-4967
  2. 2026-10-03 Alias added: GHSA-64cw-m57j-65xj

References

Patch 1

Advisory 2

Other 1

  • TI-2016-07808 Improper input validation in Ansible CVSS 3.1HIGH 8.1
  • TI-2014-03853 Injection in Ansible CVSS 3.1CRITICAL 9.8
  • TI-2014-03839 The safe_eval function in Ansible before 1.5.4 does not properly restrict the code… CVSS 3.1CRITICAL 9.8
  • TI-2017-05191 Sensitive information in log files in Red Hat ansible CVSS 3.1CRITICAL 9.8
  • TI-2014-04076 Ansible before 1.6.7 does not prevent inventory data with "{{" and "lookup" substrings… CVSS 3.1CRITICAL 9.8
  • TI-2016-07090 Command injection in Red Hat Ansible CVSS 3.0CRITICAL 9.1
See all 44 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences