CVE-2021-4041

2022-08-2415:11:13

CWE-20

redhat

www.cve.org

flaw

ansible-runner

shell command

host

virtual environment

AI Score

7.9

Confidence

High

EPSS

0.001

Percentile

32.2%

JSON

A flaw was found in ansible-runner. An improper escaping of the shell command, while calling the ansible_runner.interface.run_command, can lead to parameters getting executed as host’s shell command. A developer could unintentionally write code that gets executed in the host rather than the virtual environment.

CNA Affected

[
  {
    "product": "ansible-runner",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Fixed in ansible-runner 2.1.0"
      }
    ]
  }
]