CVE-2019-14905: Ansible Engine - OS Command Injection in nxos_file_copy Module
Summary
CVE-2019-14905: A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's nxos_file_copy module can be used to copy files to a flash or bootflash on... Affects ansible across 3 version ranges.
>= 2.7.0, < 2.7.16
>= 2.8.0, < 2.8.8
>= 2.9.0, < 2.9.3
Fixed in 2.7.16, 2.8.8 or 2.9.3, depending on the release line you run. How to fix ↓
Also tracked for
- ansible · Alpine:v3.10
The same CVE-2019-14905 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ansible Engine is an open-source automation platform that allows users to automate IT tasks such as configuration management, application deployment, and orchestration. It provides a simple and powerful way to automate complex tasks across a wide range of systems. The nxos_file_copy module in Ansible Engine is used to copy files to a flash or bootflash on NXOS devices. This module is vulnerable to OS command injection, where an attacker can manipulate the filename parameter to execute arbitrary commands on the target system. This vulnerability affects Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16, and earlier.
Vulnerability Detail
The vulnerability in Ansible Engine's nxos_file_copy module allows an attacker to inject malicious OS commands by manipulating the filename parameter. By crafting a specially crafted filename, an attacker can execute arbitrary commands on the target system. This can lead to a loss of confidentiality of the system and potentially other security issues. The vulnerability affects Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16, and earlier.
How To Fix
Latest published version: 14.5.0 as of 22 Oct 2026
pip install --upgrade "ansible==14.5.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.7.0, < 2.7.162.7.16pip install --upgrade "ansible==2.7.16" -
>= 2.8.0, < 2.8.82.8.8pip install --upgrade "ansible==2.8.8" -
>= 2.9.0, < 2.9.32.9.3pip install --upgrade "ansible==2.9.3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the latest patched versions of Ansible Engine as mentioned in the 'how_to_fix' section.
Conclusion
The vulnerability in Ansible Engine's nxos_file_copy module allows for OS command injection, which can lead to a loss of system confidentiality and other security issues. It is crucial to upgrade to the latest patched versions of Ansible Engine to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ansible →
FAQ
Ansible Engine is an open-source automation platform used for configuration management, application deployment, and orchestration.
The nxos_file_copy module in Ansible Engine is used to copy files to a flash or bootflash on NXOS devices.
OS command injection is a vulnerability that allows an attacker to execute arbitrary commands on a target system by manipulating input parameters.
This vulnerability can result in a loss of confidentiality of the system and potentially other security issues.
To fix this vulnerability, upgrade to the latest patched versions of Ansible Engine as mentioned in the 'how_to_fix' section.
Related vulnerabilities
Recent vulnerabilities recorded for ansible.
