{"schema_version":"1.8.0","id":"CVE-2018-10874","published":"2018-07-02T13:29:00.367Z","modified":"2026-08-07T11:31:12.328016237Z","aliases":["GHSA-3xvg-x47j-x75w","PYSEC-2018-81"],"related":["SUSE-SU-2018:4130-1","SUSE-SU-2024:1427-1","SUSE-SU-2024:1509-1"],"details":"In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.","affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/ansible/ansible","events":[{"introduced":"2c2dd1a1b3eca6248979e04e70afff6dd3fcf366"},{"last_affected":"8ce3bd6deaa0a0274a921c0137cbd804ffc312d0"}],"database_specific":{"cpe":["cpe:2.3:a:redhat:ansible_engine:2.5:*:*:*:*:*:*:*","cpe:2.3:a:redhat:ansible_engine:2.6:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"2.5"},{"last_affected":"2.5"},{"introduced":"2.6"},{"last_affected":"2.6"}],"source":"CPE_STRING"}}],"versions":["2.5","2.6"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-10874.json"}}],"references":[{"type":"WEB","url":"https://usn.ubuntu.com/4072-1/"},{"type":"ADVISORY","url":"http://www.securitytracker.com/id/1041396"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHBA-2018:3788"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:2150"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:2151"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:2152"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:2166"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:2321"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:2585"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2019:0054"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10874"}],"database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:a:redhat:ansible_engine:2.0:*:*:*:*:*:*:*","cpe:2.3:a:redhat:ansible_engine:2.4:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"2.0"},{"last_affected":"2.0"},{"introduced":"2.4"},{"last_affected":"2.4"}],"source":"CPE_STRING","vendor_product":"redhat:ansible_engine"},{"cpes":["cpe:2.3:a:redhat:openstack:10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openstack:12:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"10"},{"last_affected":"10"},{"introduced":"12"},{"last_affected":"12"},{"introduced":"13"},{"last_affected":"13"}],"source":"CPE_STRING","vendor_product":"redhat:openstack"},{"cpes":["cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"4.0"},{"last_affected":"4.0"}],"source":"CPE_STRING","vendor_product":"redhat:virtualization"},{"cpes":["cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"4.0"},{"last_affected":"4.0"}],"source":"CPE_STRING","vendor_product":"redhat:virtualization_host"}]},"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}