CVE-2020-1734

lowpriority · track · 30EPSS 0.005 · 40 %ileEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.46% (40th) EPSS

CVSS 3.7 · low

Is it mine?

18 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-27

A flaw was found in the pipe lookup plugin of ansible. Arbitrary commands can be run, when the pipe lookup plugin uses subprocess.Popen() with shell=True, by overwriting ansible facts and the variable is not escaped by quote plugin. An attacker could take advantage and run arbitrary commands by overwriting the ansible facts.

cvss

Technical severity, 0–10. One row per scoring source.

7.4

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–high · 3.7–7.4

v2.03.7lowAV:L/AC:H/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 1.9 · impact 6.4

v3.17.4highCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:Lprimary · NVD / NIST USexploitability 0.8 · impact 6

v3.17.4highAV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:Lsecondary · FSTEC (BDU) RU

v3.17.4highCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:Lsecondary · ENISA EU

v3.17.4highCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:Lsecondary · secalert@redhat.com USexploitability 0.8 · impact 6

v3.17.4highCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:Lsecondary · OSV

v3.16.8mediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-78USCWE-78USCWE-78US

affected products (18)

Products and version ranges known to be affected.

Red Hat Ansible≤ n/aenisa_euvdEU
Red Hat Inc. Ansible≤ 2.7.16fstec_bduRU
Red Hat Inc. Ansible≤ 2.9.6fstec_bduRU
Red Hat Inc. Ansible≤ 2.8.10fstec_bduRU
Red Hat Inc. Ansible Tower≤ 3.3.5fstec_bduRU
Red Hat Inc. Red Hat OpenStack Platform≤ 10.0fstec_bduRU
Red Hat Inc. Red Hat OpenStack Platform≤ 13.0fstec_bduRU
redhat ansible engine≤ 2.7.16nvdUScpe:2.3:a:redhat:ansible_engine:*:*:*:*:*:*:*:*
redhat ansible engine= 2.8.8nvdUScpe:2.3:a:redhat:ansible_engine:*:*:*:*:*:*:*:*
redhat ansible engine= 2.9.5nvdUScpe:2.3:a:redhat:ansible_engine:*:*:*:*:*:*:*:*
redhat ansible tower≤ 3.3.4nvdUScpe:2.3:a:redhat:ansible_tower:*:*:*:*:*:*:*:*
redhat ansible tower= 3.4.5nvdUScpe:2.3:a:redhat:ansible_tower:*:*:*:*:*:*:*:*
redhat ansible tower= 3.5.5nvdUScpe:2.3:a:redhat:ansible_tower:*:*:*:*:*:*:*:*
redhat ansible tower= 3.6.3nvdUScpe:2.3:a:redhat:ansible_tower:*:*:*:*:*:*:*:*
PyPI ansible< 2.7.17osvUSpkg:pypi/ansible
PyPI ansible< 2.8.13osvUSpkg:pypi/ansible
PyPI ansible2.10.0a1 → 2.10.0rc1osvUSpkg:pypi/ansible
PyPI ansible2.9.0a1 → 2.9.11osvUSpkg:pypi/ansible

advisories (2)

Vendor and ecosystem advisories describing this.

GHSA-h39q-95q5-9jfpOS Command Injection in ansible2022-02-09ghsa · osvUS
A flaw was found in the pipe lookup plugin of ansible. Arbitrary commands can be run, when the pipe lookup plugin uses `subprocess.Popen()` with `shell=True`, by overwriting ansible facts and the variable is not escaped by quote plugin. An attacker could take advantage and run arbitrary commands by overwriting the ansible facts.
PYSEC-2020-62020-03-03vendor · osvUS
A flaw was found in the pipe lookup plugin of ansible. Arbitrary commands can be run, when the pipe lookup plugin uses subprocess.Popen() with shell=True, by overwriting ansible facts and the variable is not escaped by quote plugin. An attacker could take advantage and run arbitrary commands by overwriting the ansible facts.

also known as (7)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv nvd NVD CVE.org MITRE

published 2020-03-03modified 2026-06-17

references (14)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan