Code injection in Tomohiro Nakamura ansible-vault
Priority LOW 39CWE-94Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-94.
Summary
An exploitable vulnerability exists in the yaml loading functionality of ansible-vault before 1.0.5. A specially crafted vault can execute arbitrary python commands resulting in command execution. An attacker can insert python into the vault to trigger this vulnerability.
Why it matters now
EPSS 0.0298 87th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed ansible-vault (PyPI): 1.0.5
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Tomohiro Nakamura | ansible-vault | 1.0.4 | — | No fix listed | CNA |
| — | ansible-vault (PyPI) | before 1.0.5 | 1.0.5 | Patch available | GHSA-c2w9-48qc-qpj4 |
- ansible-vault VendorTomohiro Nakamura Affected 1.0.4 Fixed in — No fix listed CNA
- ansible-vault (PyPI) Vendor— Affected before 1.0.5 Fixed in 1.0.5 Patch available GHSA-c2w9-48qc-qpj4
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ansible-vault_project:ansible-vault:*:*:*:*:*:*:*:* | up to 1.0.4 | Vulnerable | Ansible-vault Project |
- cpe:2.3:a:ansible-vault_project:ansible-vault:*:*:*:*:*:*:*:* Versions up to 1.0.4 Vulnerable ·Ansible-vault Project
Remediation
- Fix · GHSA-c2w9-48qc-qpj4 ansible-vault (PyPI) Fixed in 1.0.5 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2017-2809
- 2026-10-03 Alias added: GHSA-c2w9-48qc-qpj4
- 2026-11-07 Priority changed: MEDIUM → LOW
References
Advisory 5
Sources
- CVE-2017-2809 · CVE Program
- CVE-2017-2809 · NVD
- FIRST EPSS
- GHSA-c2w9-48qc-qpj4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences