CVE-2020-1734: Arbitrary Command Execution in Ansible
Summary
CVE-2020-1734: A flaw was found in the pipe lookup plugin of ansible. Affects ansible versions < 2.7.17. Fixed in 2.7.17. How to fix ↓
Also tracked for
- ansible · Debian:11
The same CVE-2020-1734 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ansible is an open-source automation tool that allows users to automate IT tasks such as configuration management, application deployment, and orchestration. It is widely used in the industry due to its simplicity and flexibility. However, a vulnerability has been discovered in the pipe lookup plugin of Ansible, which can lead to arbitrary command execution. This plugin uses the subprocess.Popen() function with shell=True, and when ansible facts are overwritten without proper escaping, an attacker can exploit this to run arbitrary commands.
Vulnerability Detail
The vulnerability (CVE-2020-1734) in Ansible allows an attacker to execute arbitrary commands by manipulating ansible facts and bypassing the quote plugin. By overwriting the ansible facts and not properly escaping the variable, an attacker can inject malicious commands that will be executed when the pipe lookup plugin is used. This can lead to unauthorized access, data leakage, and potential compromise of the entire system. The vulnerability affects Ansible versions prior to 2.7.17.
How To Fix
Latest published version: 14.5.0 as of 22 Oct 2026
pip install --upgrade "ansible==14.5.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.7.17
This is the first release that contains the fix.
pip install --upgrade "ansible==2.7.17"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating Ansible is not immediately possible, a workaround can be implemented by disabling the pipe lookup plugin. This can be done by modifying the Ansible configuration file and setting the 'lookup_plugins' option to an empty list. Here is an example of how to do this:
- Open the Ansible configuration file (ansible.cfg) in a text editor.
- Locate the 'lookup_plugins' option.
- Change the value to an empty list: 'lookup_plugins = []'
- Save the file and restart any Ansible processes.
Conclusion
In conclusion, the CVE-2020-1734 vulnerability in Ansible allows for arbitrary command execution, which can have severe consequences for affected systems. It is crucial to update Ansible to version 2.7.17 or later to mitigate this vulnerability. If immediate updating is not possible, disabling the pipe lookup plugin can serve as a temporary workaround. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ansible →
FAQ
The vulnerability allows an attacker to execute arbitrary commands, potentially leading to unauthorized access, data leakage, and compromise of the system.
The vulnerability affects Ansible versions prior to 2.7.17.
Yes, updating Ansible to version 2.7.17 or later fixes the vulnerability.
Yes, you can disable the pipe lookup plugin by modifying the Ansible configuration file and setting the 'lookup_plugins' option to an empty list.
You can find more information about this vulnerability in the official advisory database of the Python Package Index (PyPI).
Related vulnerabilities
Recent vulnerabilities recorded for ansible.
