CVE Watch9 nov 2026

CVE-2026-84503

A flaw was found in ansible-core's ansible.builtin.git module. The module invokes git (ls-remote, clone, fetch) with the repository URL as a

CVSS

6.7

Medio

EPSS

—

KEV

—

Exploit Today

0-100

Publicado: 9 nov 2026 · Última mod.: 9 nov 2026 · CWE-88

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

A flaw was found in ansible-core's ansible.builtin.git module. The module invokes git (ls-remote, clone, fetch) with the repository URL as a positional argument and without a "--" separator, so a repository URL that begins with a dash is interpreted by git as a command-line option. A caller that passes an attacker-controlled repository URL to the module can trigger argument injection (for example --upload-pack/--exec), resulting in arbitrary command execution on the host running the module.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-636447.5 ALT

—

———bird-lg-go is a BIRD looking glass in Go. Prior to version 1.4.7, unsanitized input path enables arbitrary local file read, allowing an unauthenticated remote attacker to read sensitive files such as /etc/shadow and /root/.bash_history. This issue has been patched in version 1.4.7.14h CVE-2026-828306.7 MED

53.0%

——16IBM Guardium Data Protection 12.2.4 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of argument delimiters.1d CVE-2026-174109.9 CRÍ

51.7%

——16IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters.3d CVE-2026-170622.7 BAJ

31.8%

——10IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to modify internal requests due to improper neutralization of argument delimiters. Special characters in user-supplied input are not handled safely, which could allow additional parameters to be added to a request made by the server.3d CVE-2026-1232856.3 MED

58.5%

——18In JetBrains Datalore before 2026.3 command execution was possible in the database task container via JVM options injection4d CVE-2026-1232817.5 ALT

30.5%

——9In JetBrains Datalore before 2026.4 notebook code could execute commands in the sidecar container via the mount broker4d