CVE-2014-4967: Ansible - Multiple Argument Injection Vulnerabilities
Summary
CVE-2014-4967: Multiple argument injection vulnerabilities in Ansible before 1.6.7 allow remote attackers to execute arbitrary code by leveraging access to an Ansible managed host and providing a crafted fact, as demonstrated by a fact... Affects ansible across 2 version ranges.
< 1.6.7
< 62a1295a3e08cb6c3e9f1b2a1e6e5dcaeab32527
Fixed in 62a1295a3e08cb6c3e9f1b2a1e6e5dcaeab32527. How to fix ↓
Also tracked for
- ansible · Debian:11
The same CVE-2014-4967 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ansible is an open-source automation tool that allows users to automate IT tasks such as configuration management, application deployment, and orchestration. It is widely used in the DevOps community for its simplicity and scalability. However, Ansible versions before 1.6.7 are susceptible to multiple argument injection vulnerabilities, which can be exploited by remote attackers with access to an Ansible managed host. These vulnerabilities arise from the improper handling of crafted facts, allowing the execution of arbitrary code on the target system.
Vulnerability Detail
The vulnerability in Ansible versions prior to 1.6.7 stems from the lack of proper input validation when processing certain facts. An attacker who can provide a crafted fact to an Ansible managed host can exploit this vulnerability to execute arbitrary code. There are three specific scenarios where this vulnerability can be leveraged: 1) by appending a trailing " src=" clause to a fact, 2) by appending a trailing " temp=" clause to a fact, or 3) by appending a trailing " validate=" clause accompanied by a shell command. Successful exploitation of this vulnerability can lead to unauthorized code execution and potential compromise of the target system.
How To Fix
Latest published version: 14.5.0 as of 22 Oct 2026
pip install --upgrade "ansible==14.5.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
62a1295a3e08cb6c3e9f1b2a1e6e5dcaeab32527
This is the first release that contains the fix.
pip install --upgrade "ansible==62a1295a3e08cb6c3e9f1b2a1e6e5dcaeab32527"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can implement strict input validation and sanitization of facts before processing them with Ansible. This can be achieved by implementing custom input filters or using third-party libraries that provide secure input handling. However, applying the official fix by upgrading to Ansible version 1.6.7 or later is the recommended approach.
Conclusion
The multiple argument injection vulnerabilities in Ansible versions prior to 1.6.7 can allow remote attackers to execute arbitrary code on an Ansible managed host. To mitigate this vulnerability, it is crucial to upgrade to Ansible version 1.6.7 or later. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ansible →
FAQ
Ansible is an open-source automation tool used for configuration management, application deployment, and orchestration.
Versions of Ansible prior to 1.6.7 are affected by this vulnerability.
An attacker with access to an Ansible managed host can exploit this vulnerability by providing a crafted fact with specific trailing clauses, allowing the execution of arbitrary code.
Successful exploitation of this vulnerability can lead to unauthorized code execution on the target system, potentially resulting in compromise of sensitive data or disruption of services.
While implementing strict input validation and sanitization of facts can serve as a temporary workaround, it is recommended to upgrade to Ansible version 1.6.7 or later to fully mitigate this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for ansible.
