https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 17:54:49 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-84714 <p>A flaw was found in the automation-controller input-validation guard sanitize_jinja(). The function uses two regular expressions to reject user-supplied Jinja, but the patterns stop at the first interior &#39;}&#39; or &#39;%&#39; character, so a Jinja expression containing an inner brace (for example an empty dict) is accepted while remaining valid Jinja. Because sanitize_jinja() is the sole guard on several launch-time fields — ad-hoc command module_args, Machine-credential username / become_method / become_user, and inventory host names — a low-privileged user can inject Jinja that ansible-core evaluates in the execution environment. This enables execution of arbitrary commands in the execution environment (bypassing an administrator&#39;s AD_HOC_COMMANDS module allowlist) and disclosure of secrets belonging to credentials the attacker cannot read (by templating a co-attached credential&#39;s injected environment variables), across the credential access-control boundary.</p> <p>A flaw was found in the automation-controller input-validation guard sanitize_jinja(). The function uses two regular expressions to reject user-supplied Jinja, but the patterns stop at the first interior &#39;}&#39; or &#39;%&#39; character, so a Jinja expression containing an inner brace (for example an empty dict) is accepted while remaining valid Jinja. Because sanitize_jinja() is the sole guard on several launch-time fields — ad-hoc command module_args, Machine-credential username / become_method / become_user, and inventory host names — a low-privileged user can inject Jinja that ansible-core evaluates in the execution environment. This enables execution of arbitrary commands in the execution environment (bypassing an administrator&#39;s AD_HOC_COMMANDS module allowlist) and disclosure of secrets belonging to credentials the attacker cannot read (by templating a co-attached credential&#39;s injected environment variables), across the credential access-control boundary.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-84714 https://vulnerability.circl.lu/vuln/ghsa-8ghh-482v-94qp <p>A flaw was found in the automation-controller input-validation guard sanitize_jinja(). The function uses two regular expressions to reject user-supplied Jinja, but the patterns stop at the first interior &#39;}&#39; or &#39;%&#39; character, so a Jinja expression containing an inner brace (for example an empty dict) is accepted while remaining valid Jinja. Because sanitize_jinja() is the sole guard on several launch-time fields — ad-hoc command module_args, Machine-credential username / become_method / become_user, and inventory host names — a low-privileged user can inject Jinja that ansible-core evaluates in the execution environment. This enables execution of arbitrary commands in the execution environment (bypassing an administrator&#39;s AD_HOC_COMMANDS module allowlist) and disclosure of secrets belonging to credentials the attacker cannot read (by templating a co-attached credential&#39;s injected environment variables), across the credential access-control boundary.</p> <p>A flaw was found in the automation-controller input-validation guard sanitize_jinja(). The function uses two regular expressions to reject user-supplied Jinja, but the patterns stop at the first interior &#39;}&#39; or &#39;%&#39; character, so a Jinja expression containing an inner brace (for example an empty dict) is accepted while remaining valid Jinja. Because sanitize_jinja() is the sole guard on several launch-time fields — ad-hoc command module_args, Machine-credential username / become_method / become_user, and inventory host names — a low-privileged user can inject Jinja that ansible-core evaluates in the execution environment. This enables execution of arbitrary commands in the execution environment (bypassing an administrator&#39;s AD_HOC_COMMANDS module allowlist) and disclosure of secrets belonging to credentials the attacker cannot read (by templating a co-attached credential&#39;s injected environment variables), across the credential access-control boundary.</p> https://vulnerability.circl.lu/vuln/ghsa-8ghh-482v-94qp https://vulnerability.circl.lu/vuln/rhsa-2026:71113 <p>Automation-Controller: automation-controller: Kubernetes service account token exfiltration via HashiCorp Vault credential SSRF encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service html/template: golang: Go html/template: Cross-Site Scripting via pathological input encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages js-yaml: js-yaml: Denial of Service via crafted YAML documents sqlparse: sqlparse: Denial of Service via inefficient SQL parsing nanoid: nanoid: Denial of Service via negative size input in non-secure module functions gitpython: GitPython: Environment variable exfiltration via attacker-controlled clone URL gitpython: GitPython: Arbitrary code execution via command injection due to unguarded Git options gitpython: GitPython: Command Injection via Git option prefix abbreviation postcss: PostCSS: Information disclosure via crafted sourceMappingURL automation-controller: automation-controller-container: automation-controller: Named-URL 404 body oracle enable…</p> <p>Automation-Controller: automation-controller: Kubernetes service account token exfiltration via HashiCorp Vault credential SSRF encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service html/template: golang: Go html/template: Cross-Site Scripting via pathological input encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages js-yaml: js-yaml: Denial of Service via crafted YAML documents sqlparse: sqlparse: Denial of Service via inefficient SQL parsing nanoid: nanoid: Denial of Service via negative size input in non-secure module functions gitpython: GitPython: Environment variable exfiltration via attacker-controlled clone URL gitpython: GitPython: Arbitrary code execution via command injection due to unguarded Git options gitpython: GitPython: Command Injection via Git option prefix abbreviation postcss: PostCSS: Information disclosure via crafted sourceMappingURL automation-controller: automation-controller-container: automation-controller: Named-URL 404 body oracle enable…</p> https://vulnerability.circl.lu/vuln/rhsa-2026:71113