CVE-2014-4966
Ansible Arbitrary Code Execution
Ansible before 1.6.7 does not prevent inventory data with "{{" and "lookup" substrings, and does not prevent remote data with "{{" substrings, which allows remote attackers to execute arbitrary code via (1) crafted lookup('pipe') calls or (2) crafted Jinja2 data.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Ansible before 1.6.7 does not prevent inventory data with "{{" and "lookup" substrings, and does not prevent remote data with "{{" substrings, which allows remote attackers to execute arbitrary code via (1) crafted lookup('pipe') calls or (2) crafted Jinja2 data.
- Record
CVE-2014-4966- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-74
- Updated
- 2026-11-02
CVE List No score
Ansible before 1.6.7 does not prevent inventory data with "{{" and "lookup" substrings, and does not prevent remote data with "{{" substrings, which allows remote attackers to execute arbitrary code via (1) crafted lookup('pipe') calls or (2) crafted Jinja2 data.
- Record
CVE-2014-4966- Updated
- 2026-11-02
EUVDEUVD-2020-0016 No score
Ansible before 1.6.7 does not prevent inventory data with "{{" and "lookup" substrings, and does not prevent remote data with "{{" substrings, which allows remote attackers to execute arbitrary code via (1) crafted lookup('pipe') calls or (2) crafted Jinja2 data.
- Record
EUVD-2020-0016- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wqq5-c89p-3wc3
Ansible Arbitrary Code Execution
Ansible before 1.6.7 does not prevent inventory data with "{{" and "lookup" substrings, and does not prevent remote data with "{{" substrings, which allows remote attackers to execute arbitrary code via (1) crafted lookup('pipe') calls or (2) crafted Jinja2 data.
- Record
GHSA-wqq5-c89p-3wc3- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-74
- Updated
- 2026-11-02
OSV
Ansible before 1.6.7 does not prevent inventory data with "{{" and "lookup" substrings, and does not prevent remote data with "{{" substrings, which allows remote attackers to execute arbitrary code via (1) crafted lookup('pipe') calls or (2) crafted Jinja2 data.
- Record
CVE-2014-4966- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-4966
Ansible before 1.6.7 does not prevent inventory data with "{{" and "lookup" substrings, and does not prevent remote data with "{{" substrings, which allows remote attackers to execute arbitrary code via (1) crafted lookup('pipe') calls or (2) crafted Jinja2 data.
- Record
DEBIAN-CVE-2014-4966- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 10 moreShow less
OSVGHSA-wqq5-c89p-3wc3
Ansible Arbitrary Code Execution
Ansible before 1.6.7 does not prevent inventory data with "{{" and "lookup" substrings, and does not prevent remote data with "{{" substrings, which allows remote attackers to execute arbitrary code via (1) crafted lookup('pipe') calls or (2) crafted Jinja2 data.
- Record
GHSA-wqq5-c89p-3wc3- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-74
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-4966
Ansible before 1.6.7 does not prevent inventory data with "{{" and "lookup" substrings, and does not prevent remote data with "{{" substrings, which allows remote attackers to execute arbitrary code via (1) crafted lookup('pipe') calls or (2) crafted Jinja2 data.
- Record
UBUNTU-CVE-2014-4966- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2014-0350 No score
Updated ansible package fixes multiple security issues
Updated ansible package fixes security vulnerabilities:
The Ansible platform before version 1.6.7 suffers from input sanitization errors that allow arbitrary code execution as well as information leak, in case an attacker is able to control certain playbook variables (CVE-2014-4678, CVE-2014-4966, CVE-2014-4967).
The ansible package has been updated to version 1.6.8, which fixes these issues and several other bugs.
- Record
MGASA-2014-0350- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10326-1 No score
ansible-2.2.0.0-1.1 on GA media
These are all security issues fixed in the ansible-2.2.0.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10326-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14244-1 No score
ansible-9-9.8.0-1.1 on GA media
These are all security issues fixed in the ansible-9-9.8.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14244-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14536-1 No score
ansible-10-10.6.0-1.1 on GA media
These are all security issues fixed in the ansible-10-10.6.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14536-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15605-1 No score
ansible-11-11.11.0-1.1 on GA media
These are all security issues fixed in the ansible-11-11.11.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15605-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15753-1 No score
ansible-12-12.2.0-1.1 on GA media
These are all security issues fixed in the ansible-12-12.2.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15753-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10944-1 No score
ansible-13-13.7.0-1.1 on GA media
These are all security issues fixed in the ansible-13-13.7.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10944-1- Updated
- 2026-11-02
OSVPYSEC-2020-204 No score
Ansible before 1.6.7 does not prevent inventory data with "{{" and "lookup" substrings, and does not prevent remote data with "{{" substrings, which allows remote attackers to execute arbitrary code via (1) crafted lookup('pipe') calls or (2) crafted Jinja2 data.
- Record
PYSEC-2020-204- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ansiblePyPI |
before 1.6.7 | 1.6.7 |
ansibleDebian:12 |
before 1.6.8+dfsg-1 | 1.6.8+dfsg-1 |
ansibleDebian:13 |
before 1.6.8+dfsg-1 | 1.6.8+dfsg-1 |
ansibleDebian:14 |
before 1.6.8+dfsg-1 | 1.6.8+dfsg-1 |
ansiblePyPI |
before 1.6.7, plus listed versions 1.01.11.21.2.11.2.2 Show 25 moreShow less1.2.31.3.01.3.11.3.21.3.31.3.41.41.4.11.4.21.4.31.4.41.4.51.51.5.11.5.21.5.31.5.41.5.51.61.6.11.6.21.6.31.6.41.6.51.6.6 |
1.6.7 |
ansibleMageia:4 From an advisory covering 3 CVEs |
before 1.6.10-1.mga4 | 1.6.10-1.mga4 |
ansiblePyPI |
before 1.6.7, plus listed versions 1.01.11.21.2.11.2.2 Show 40 moreShow less1.2.31.3.01.3.11.3.21.3.31.3.41.41.4.11.4.21.4.31.4.41.4.51.51.5.11.5.21.5.31.5.41.5.51.61.6.11.6.21.6.31.6.41.6.51.6.6v1.6.6v1.6.5v1.6.4v1.6.3v1.6.2v1.6.1v1.6.0v1.4.0v1.2v1.1v1.00.70.30.0.10.01 |
1.6.7 |
ansibleUbuntu:Pro:14.04:LTS |
before 1.5.4+dfsg-1ubuntu0.1~esm2, plus listed versions 1.1+dfsg-11.3.4+dfsg-11.4.0+dfsg-11.4.1+dfsg-11.4.3+dfsg-11.4.4+dfsg-11.5.4+dfsg-11.5.4+dfsg-1ubuntu0.1~esm1 |
1.5.4+dfsg-1ubuntu0.1~esm2 |
ansibleopenSUSE:Tumbleweed From an advisory covering 4 CVEs |
before 2.2.0.0-1.1 | 2.2.0.0-1.1 |
ansible-9openSUSE:Tumbleweed From an advisory covering 45 CVEs |
before 9.8.0-1.1 | 9.8.0-1.1 |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
ansible-10openSUSE:Tumbleweed From an advisory covering 45 CVEs |
before 10.6.0-1.1 | 10.6.0-1.1 |
ansible-11openSUSE:Tumbleweed From an advisory covering 45 CVEs |
before 11.11.0-1.1 | 11.11.0-1.1 |
ansible-12openSUSE:Tumbleweed From an advisory covering 45 CVEs |
before 12.2.0-1.1 | 12.2.0-1.1 |
ansible-13openSUSE:Tumbleweed From an advisory covering 45 CVEs |
before 13.7.0-1.1 | 13.7.0-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-4966 is a critical vulnerability (CVSS 9.8) in Redhat Ansible, published August 25, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.52%, the 89th percentile. Fixed in ansible 1.6.7.
References
ocert.org/advisories/ocert-2014-004.html
github.com/ansible/ansible/commit/62a1295a3e08cb6c3e9f1b2a1e6e5dcaeab32527
nvd.nist.gov/vuln/detail/CVE-2014-4966
security-tracker.debian.org/tracker/CVE-2014-4966
Show 56 moreShow less
advisories.mageia.org/MGASA-2014-0350.html
bugs.mageia.org/show_bug.cgi?id=13649
openwall.com/lists/oss-security/2014/07/02/2
lists.fedoraproject.org/pipermail/package-announce/2014-July/135284.html
ubuntu.com/security/CVE-2014-4966
openwall.com/lists/oss-security/2014/07/22
cve.org/CVERecord?id=CVE-2014-4966
suse.com/security/cve/CVE-2014-4966
lists.opensuse.org/archives/list/[email protected]/thread/7LWEIR2LXW4QRWCY6HDMLUO2OTX5OZIC