CVE-2021-4041

HIGH

ansible-runner < 2.1.0 - Command Injection via Improper Shell Command Escaping

Title source: llm
STIX 2.1

Description

A flaw was found in ansible-runner. An improper escaping of the shell command, while calling the ansible_runner.interface.run_command, can lead to parameters getting executed as host's shell command. A developer could unintentionally write code that gets executed in the host rather than the virtual environment.

References (3)

Core 3
Core References
Issue Tracking, Patch, Vendor Advisory x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=2028074
Vendor Advisory x_refsource_misc
https://access.redhat.com/security/cve/CVE-2021-4041

Scores

CVSS v3 7.8
EPSS 0.0007
EPSS Percentile 21.4%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-20 CWE-116
Status published
Products (3)
pypi/ansible-runner 0 - 2.1.0PyPI
redhat/ansible_runner 2.1.0 alpha1 (3 CPE variants)
redhat/ansible_runner < 2.1.0
Published Aug 24, 2022
Tracked Since Feb 18, 2026