CVE-2021-4041

ansible-runner vulnerable to shell command injection

7.8 HighFix available

CVE-2021-4041 is a high vulnerability (CVSS 7.8) in Redhat Ansible Runner, published August 24, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 26th percentile. Fixed in ansible-runner 2.1.0.

A flaw was found in ansible-runner. An improper escaping of the shell command, while calling the ansible_runner.interface.run_command, can lead to parameters getting executed as host's shell command. A developer could unintentionally write code that gets executed in the host rather than the virtual environment.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.33%Down 0.6 points since Aug 25, 2022

What each source reports

NVD Score used 7.8

Record: CVE-2021-4041
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-20, CWE-116
Updated: 2026-11-02

CVE List No score

Record: CVE-2021-4041
Weakness: CWE-20
Updated: 2026-11-02

EUVDEUVD-2022-0003 No score

Record: EUVD-2022-0003
Updated: 2026-11-03

GitHub AdvisoriesGHSA-6j58-grhv-2769 8.5

ansible-runner vulnerable to shell command injection

A flaw was found in ansible-runner. An improper escaping of the shell command, while calling the ansible_runner.interface.run_command, can lead to parameters getting executed as host's shell command. A developer could unintentionally write code that gets executed in the host rather than the virtual environment.

Record: GHSA-6j58-grhv-2769
CVSS 4.0: 8.5 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-20, CWE-116
Updated: 2026-11-02

OSV 7.8

Record: CVE-2021-4041
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2021-4041 7.8

Record: DEBIAN-CVE-2021-4041
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 4 moreShow less

OSVGHSA-6j58-grhv-2769 8.5

ansible-runner vulnerable to shell command injection

Record: GHSA-6j58-grhv-2769
CVSS 4.0: 8.5 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-116, CWE-20
Updated: 2026-11-02

OSVRHSA-2022:0108 7.3

Red Hat Security Advisory: ansible-runner security and bug fix update

Record: RHSA-2022:0108
CVSS 3.1: 7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2021-4041 7.8

Record: UBUNTU-CVE-2021-4041
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVPYSEC-2022-253 No score

Record: PYSEC-2022-253
Updated: 2026-11-02

Affected products

redhat ansible runner

Affected packages

Affected packages
Package	Affected	Fixed
`ansible-runner` PyPI	before 2.1.0	2.1.0
`ansible-runner` Debian:12	before 2.1.1-1	2.1.1-1
`ansible-runner` Debian:13	before 2.1.1-1	2.1.1-1
`ansible-runner` Debian:14	before 2.1.1-1	2.1.1-1
`ansible-runner` PyPI	before 2.1.0, plus listed versions 1.0.11.0.21.0.31.0.41.0.5 Show 35 moreShow less 1.1.01.1.11.1.21.2.01.3.01.3.11.3.21.3.31.3.41.4.01.4.11.4.21.4.41.4.51.4.61.4.71.4.81.4.92.0.02.0.0.0a52.0.0.0b12.0.0.0rc12.0.0.0rc22.0.0.0rc32.0.0a12.0.0a22.0.0a32.0.0a42.0.12.0.22.0.32.0.42.1.0.0a12.1.0.0a22.1.0.0b1	2.1.0
`ansible-runner` Red Hat:ansible_automation_platform:2.0::el8	before 0:2.0.3-2.el8ap	0:2.0.3-2.el8ap
`python38-ansible-runner` Red Hat:ansible_automation_platform:2.0::el8	before 0:2.0.3-2.el8ap	0:2.0.3-2.el8ap
`ansible-runner` Ubuntu:22.04:LTS	before 2.1.1-1, plus listed versions 1.4.6-11.4.6-1.1	2.1.1-1

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 7 moreShow less