CVSS 3.0
7.8 highCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVE-2018-10874
High (7.8) in redhat. EPSS 0.5% chance of exploitation in the next 30 days. Fixed in ansible 2.4.6.0, 2.5.6, 2.6.1.
In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.
Severity
- EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 42% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-426, CWE-20
- Published
- Modified
- Record from
- the NVD, synced
Affected
- redhat:ansible_engine
- redhat:openstack
- redhat:virtualization
- redhat:virtualization_host
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-3xvg-x47j-x75w | PyPI | ansible | <2.4.6.0 | 2.4.6.0 |
| GHSA-3xvg-x47j-x75w | PyPI | ansible | >=2.5 <2.5.6 | 2.5.6 |
| GHSA-3xvg-x47j-x75w | PyPI | ansible | >=2.6 <2.6.1 | 2.6.1 |
| PYSEC-2018-81 | PyPI | ansible | <2.4.6.0 >=2.5 <2.5.6 >=2.6 <2.6.1 | 2.4.6.0, 2.5.6, 2.6.1 |