CVE-2025-49520 Event-driven-ansible: authenticated argument injection in git url in eda project creation
Authenticated attackers can inject arguments into git commands to execute arbitrary code and steal cluster tokens in Ansible EDA.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-49520?
CVE-2025-49520 is a high-severity command injection vulnerability in Red Hat Ansible Automation Platform 2.5 for RHEL 8, published on 30 Jun 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A flaw was found in Ansible Automation Platform’s EDA component where user-supplied Git URLs are passed unsanitized to the git ls-remote command. This vulnerability allows an authenticated attacker to inject arguments and execute arbitrary commands on the EDA worker. In Kubernetes/OpenShift environments, this can lead to service account token theft and cluster access.
Weakness: CWE-88
Which versions are affected by CVE-2025-49520?
How do I fix CVE-2025-49520?
Apply the vendor's patch.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-49520 being exploited?
There is no known exploitation of CVE-2025-49520 in the wild and no public exploit code.
Sources
Also known as GHSA-wxwr-926x-hcq6.