CVE-2026-71465 [LOW] – RunAdHocCommand.build_args() appends limit as bare positional (args.append(l

RunAdHocCommand.build_args() appends limit as bare
positional (args.append(limit)) instead of using
args.extend([‘-l’, limit]) like RunJob. A limit beginning
with – is parsed as an ansible CLI option. Currently
limited to short-circuit flags (–version, –help) since
injected element displaces required pattern positional.
Would escalate if ansible-core ever defaults pattern.