Every CVE Search/ Get API key

CVE-2014-4678

Ansible Code Injection Vulnerability

9.8 CriticalFix available

The safe_eval function in Ansible before 1.6.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-4657.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

5.34%Down 1.4 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 9.8

The safe_eval function in Ansible before 1.6.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-4657.

Record
CVE-2014-4678
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-74
Updated
2026-11-02
CVE List No score

The safe_eval function in Ansible before 1.6.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-4657.

Record
CVE-2014-4678
Updated
2026-11-02
EUVDEUVD-2020-0015 No score

The safe_eval function in Ansible before 1.6.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-4657.

Record
EUVD-2020-0015
Updated
2026-11-03
GitHub AdvisoriesGHSA-66c7-5pwv-mm3j 9.3

Ansible Code Injection Vulnerability

The safe_eval function in Ansible before 1.6.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-4657.

Record
GHSA-66c7-5pwv-mm3j
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-74
Updated
2026-11-02
OSV 9.8

The safe_eval function in Ansible before 1.6.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-4657.

Record
CVE-2014-4678
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2014-4678 9.8

The safe_eval function in Ansible before 1.6.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-4657.

Record
DEBIAN-CVE-2014-4678
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 4 moreShow less
OSVGHSA-66c7-5pwv-mm3j 9.3

Ansible Code Injection Vulnerability

The safe_eval function in Ansible before 1.6.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-4657.

Record
GHSA-66c7-5pwv-mm3j
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-74
Updated
2026-11-02
OSVUBUNTU-CVE-2014-4678 9.8

The safe_eval function in Ansible before 1.6.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-4657.

Record
UBUNTU-CVE-2014-4678
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2014-0350 No score

Updated ansible package fixes multiple security issues

Updated ansible package fixes security vulnerabilities:

The Ansible platform before version 1.6.7 suffers from input sanitization errors that allow arbitrary code execution as well as information leak, in case an attacker is able to control certain playbook variables (CVE-2014-4678, CVE-2014-4966, CVE-2014-4967).

The ansible package has been updated to version 1.6.8, which fixes these issues and several other bugs.

Record
MGASA-2014-0350
Updated
2026-11-02
OSVPYSEC-2020-203 No score

The safe_eval function in Ansible before 1.6.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-4657.

Record
PYSEC-2020-203
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
ansible
PyPI
 before 1.6.4
1.6.4
ansible
Debian:12
 before 1.6.6+dfsg-1
1.6.6+dfsg-1
ansible
Debian:13
 before 1.6.6+dfsg-1
1.6.6+dfsg-1
ansible
Debian:14
 before 1.6.6+dfsg-1
1.6.6+dfsg-1
ansible
PyPI
 before 1.6.4, plus listed versions
1.01.11.21.2.11.2.2
Show 22 moreShow less
1.2.31.3.01.3.11.3.21.3.31.3.41.41.4.11.4.21.4.31.4.41.4.51.51.5.11.5.21.5.31.5.41.5.51.61.6.11.6.21.6.3
1.6.4
ansible
Mageia:4
From an advisory covering 3 CVEs
 before 1.6.10-1.mga4
1.6.10-1.mga4
ansible
PyPI
 before 1.6.4, plus listed versions
1.01.11.21.2.11.2.2
Show 31 moreShow less
1.2.31.3.01.3.11.3.21.3.31.3.41.41.4.11.4.21.4.31.4.41.4.51.51.5.11.5.21.5.31.5.41.5.51.61.6.11.6.21.6.3v1.6.0v1.4.0v1.2v1.1v1.00.70.30.0.10.01
1.6.4
ansible
Ubuntu:Pro:14.04:LTS
 before 1.5.4+dfsg-1ubuntu0.1~esm2, plus listed versions
1.1+dfsg-11.3.4+dfsg-11.4.0+dfsg-11.4.1+dfsg-11.4.3+dfsg-11.4.4+dfsg-11.5.4+dfsg-11.5.4+dfsg-1ubuntu0.1~esm1
1.5.4+dfsg-1ubuntu0.1~esm2

History

History
RecordedChangedSources
affected, facts
aliases, productsEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-4678 is a critical vulnerability (CVSS 9.8) in Red Hat Ansible, published August 25, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.34%, the 92nd percentile. Fixed in ansible 1.6.4.

References

Show 12 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open