{"id":28220,"date":"2026-09-24T04:31:55","date_gmt":"2026-09-23T20:31:55","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-84714"},"modified":"2026-09-24T04:31:55","modified_gmt":"2026-09-23T20:31:55","slug":"cve-2026-84714","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-84714","title":{"rendered":"CVE-2026-84714 [HIGH] &#8211; A flaw was found in the automation-controller input-validation\n                  guard san"},"content":{"rendered":"<p>A flaw was found in the automation-controller input-validation<br \/>\n                  guard sanitize_jinja(). The function uses two regular<br \/>\n                  expressions to reject user-supplied Jinja, but the patterns<br \/>\n                  stop at the first interior &#8216;}&#8217; or &#8216;%&#8217; character, so a Jinja<br \/>\n                  expression containing an inner brace (for example an empty<br \/>\n                  dict) is accepted while remaining valid Jinja. Because<br \/>\n                  sanitize_jinja() is the sole guard on several launch-time<br \/>\n                  fields \u2014 ad-hoc command module_args, Machine-credential<br \/>\n                  username \/ become_method \/ become_user, and inventory host<br \/>\n                  names \u2014 a low-privileged user can inject Jinja that ansible-core<br \/>\n                  evaluates in the execution environment. This enables execution<br \/>\n                  of arbitrary commands in the execution environment (bypassing an<br \/>\n                  administrator&#8217;s AD_HOC_COMMANDS module allowlist) and disclosure<br \/>\n                  of secrets belonging to credentials the attacker cannot read<br \/>\n                  (by templating a co-attached credential&#8217;s injected environment<br \/>\n                  variables), across the credential access-control boundary.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A flaw was found in the automation-controller input-validation<br \/>\n                  guard sanitize_jinja(). The function uses two regular<br \/>\n                  expressions to reject user-supplied Jinja, but <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-28220","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/28220","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=28220"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=28220"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=28220"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}