CVE-2021-3583: Template Injection Vulnerability in Ansible
Summary
CVE-2021-3583: A flaw was found in Ansible, where a user's controller is vulnerable to template injection. Affects ansible versions < 2.9.23. Fixed in 2.9.23. How to fix ↓
Also tracked for
- ansible · Debian:11
The same CVE-2021-3583 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ansible is an open-source automation tool that allows users to automate tasks such as configuration management, application deployment, and orchestration. It uses a declarative language to describe system configurations and relies on modules to perform specific tasks on managed nodes. Ansible is widely used in IT infrastructure management and has a large community of contributors and users. However, a vulnerability has been discovered in Ansible that allows for template injection, potentially leading to command injection and disclosure of sensitive information.
Vulnerability Detail
The vulnerability in Ansible arises when a user's controller processes templates that contain multi-line YAML strings. If the facts used in the template do not routinely include special template characters, an attacker can exploit this flaw to perform command injection. This can result in the disclosure of sensitive information and compromise the confidentiality and integrity of the system. The vulnerability has been assigned CVE-2021-3583 and is also tracked as GHSA-2pfh-q76x-gwvm.
How To Fix
Latest published version: 14.5.0 as of 22 Oct 2026
pip install --upgrade "ansible==14.5.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.9.23
This is the first release that contains the fix.
pip install --upgrade "ansible==2.9.23"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating Ansible is not immediately feasible, users can implement a workaround by ensuring that the facts used in templates always include special template characters. This can help prevent the template injection vulnerability from being exploited. Here is an example of how to modify a template to include special characters:
- name: Example Template
template:
src: example.j2
dest: /path/to/destination
validate: /usr/bin/validate-command
Conclusion
The template injection vulnerability in Ansible (CVE-2021-3583) poses a risk to the confidentiality and integrity of systems using the affected versions. It is crucial to update Ansible to version 2.9.23 or later to mitigate this vulnerability. If immediate updating is not possible, implementing the provided workaround can help reduce the risk. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ansible →
FAQ
Ansible is an open-source automation tool used for configuration management, application deployment, and orchestration.
Template injection is a vulnerability that occurs when user input is not properly sanitized and is included in a template. This can lead to the execution of arbitrary code and potential information disclosure.
The vulnerability in Ansible allows for template injection, which can be exploited to perform command injection and disclose sensitive information. This can compromise the confidentiality and integrity of the system.
To fix this vulnerability, update Ansible to version 2.9.23 or later. Alternatively, ensure that the facts used in templates always include special template characters.
Yes, if updating Ansible is not immediately feasible, you can modify templates to include special characters in the facts used. This can help mitigate the risk of template injection.
References
Related vulnerabilities
Recent vulnerabilities recorded for ansible.
