RunAdHocCommand.build_args() appends limit as bare positional (args.append(limit)) instead of using args.extend(['-l', limit]) like RunJob. A limit beginning with - is parsed as an ansible CLI option. Currently limited to short-circuit flags (--version, --help) since injected element displaces required pattern positional. Would escalate if ansible-core ever defaults pattern.
CVSS Details
- CVSS 3.1 Base Score: 3.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat_linux | — | Upgrade automation-gateway-proxy-serverUpgrade python3-sqlparseUpgrade python3.12-django-ansible-base+jwt_consumerUpgrade python3.12-django-ansible-base+activitystreamUpgrade automation-eda-controller-baseUpgrade automation-controllerUpgrade automation-gateway-proxy-debugsourceUpgrade automation-gateway-proxyUpgrade python3.12-gitpythonUpgrade receptor-debugsourceUpgrade receptor-debuginfoUpgrade python3.12-django-ansible-base+oauth2_providerUpgrade python3.12-sqlparseUpgrade automation-eda-controllerUpgrade automation-eda-controller-base-servicesUpgrade python3.12-galaxy-ngUpgrade python3.12-django-ansible-base+channel_authUpgrade python3.12-django-ansible-base+authenticationUpgrade automation-gateway-configUpgrade python3.12-django-ansible-base+rest_filtersUpgrade python3.12-django-ansible-baseUpgrade automation-controller-cliUpgrade automation-controller-venv-towerUpgrade automation-platform-uiUpgrade automation-hubUpgrade aap-metrics-utilityUpgrade automation-eda-controller-worker-servicesUpgrade python3.12-django-ansible-base+rbacUpgrade python3.12-django-ansible-base+resource_registryUpgrade receptorctlUpgrade automation-controller-uiUpgrade automation-gateway-serverUpgrade automation-gateway-proxy-server-debuginfoUpgrade python3.12-django-ansible-base+feature_flagsUpgrade receptorUpgrade python3.12-django-ansible-base+api_documentationUpgrade automation-gatewayUpgrade python3.12-django-ansible-base+redis_clientUpgrade automation-controller-serverUpgrade automation-eda-controller-event-stream-services | Sep 25, 2026 | Sep 6, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub