Vulnerabilities

TI-2025-31538 CVE-2025-49520 · GHSA-wxwr-926x-hcq6

Event-driven-ansible: authenticated argument injection in git url in eda project creation

MEDIUM 41

A flaw was found in Ansible Automation Platform’s EDA component where user-supplied Git URLs are passed unsanitized to the git ls-remote command.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00624 Published 2025-06-30 Fixed in 1.1.11-1.el8ap, 1.1.11-1.el9ap CWE-88

TI-2025-31539 CVE-2025-49521 · GHSA-g6ph-9xfv-87c2

Event-driven-ansible: template injection via git branch and refspec in eda projects

MEDIUM 41

A flaw was found in the EDA component of the Ansible Automation Platform, where user-supplied Git branch or refspec values are evaluated as Jinja2 templates.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00599 Published 2025-06-30 Fixed in 1.1.11-1.el8ap, 1.1.11-1.el9ap CWE-94

Vulnerabilities

Filters

Event-driven-ansible: authenticated argument injection in git url in eda project creation

Event-driven-ansible: template injection via git branch and refspec in eda projects