CVE-2020-1734

A flaw was found in the pipe lookup plugin of ansible. Arbitrary commands can be run, when the pipe lookup plugin uses subprocess.Popen() with shell=True, by overwriting ansible facts and the variable is not escaped by quote plugin. An attacker could take advantage and run arbitrary commands by overwriting the ansible facts.

• CWE-78
• CWE-78

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1734Issue Tracking, Third Party Advisory
• https://github.com/ansible/ansible/issues/67792Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1734Issue Tracking, Third Party Advisory
• https://github.com/ansible/ansible/issues/67792Third Party Advisory

Published

Mar 3, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-1728A vulnerability was found in all versions of Keycloak where,…5.4
• CVE-2020-1729A flaw was found in SmallRye's API through version 1.6.1. Th…4.4
• CVE-2020-1730A flaw was found in libssh versions before 0.8.9 and before …5.3
• CVE-2020-1731A flaw was found in all versions of the Keycloak operator, b…9.8
• CVE-2020-1732A flaw was found in Soteria before 1.0.1, in a way that mult…4.2
• CVE-2020-1733A race condition flaw was found in Ansible Engine 2.7.17 and…5
• CVE-2020-1735A flaw was found in the Ansible Engine when the fetch module…4.6
• CVE-2020-17352Two OS command injection vulnerabilities in the User Portal …8.8
• CVE-2020-17353scm/define-stencil-commands.scm in LilyPond through 2.20.0, …9.8
• CVE-2020-17354LilyPond before 2.24 allows attackers to bypass the -dsafe p…8.6
• CVE-2020-17355Arista EOS before 4.21.12M, 4.22.x before 4.22.7M, 4.23.x be…7.5
• CVE-2020-1736A flaw was found in Ansible Engine when a file is moved usin…3.3