Argument Injection Vulnerability in Ansible Core's Git Module

CVE-2026-84503

What is CVE-2026-84503?

A security flaw exists in Ansible Core's Git module where the module incorrectly handles arguments when invoking git commands (ls-remote, clone, fetch). Specifically, when a repository URL starts with a dash, it may be misinterpreted as a command-line option due to the absence of a '--' separator. This oversight allows malicious users to supply crafted repository URLs. As a result, they can execute arbitrary commands on affected systems, leading to potential system compromises.

References