PyPI · pypi.org
ansible-core
Py Import Time Subprocess: subprocess call with shell=True — passes argv to /bin/sh.
Why PkgRadar flagged 2.16.19rc1
| Severity | Signal | Evidence |
|---|---|---|
| medium | Py Import Time Subprocess | subprocess call with shell=True — passes argv to /bin/sh. · ansible_core-2.16.19rc1/lib/ansible/cli/__init__.py |
| medium | Py Import Time Subprocess | subprocess call — process spawning. · ansible_core-2.16.19rc1/lib/ansible/cli/__init__.py |
| medium | Py Import Time Subprocess | subprocess call — process spawning. · ansible_core-2.16.19rc1/lib/ansible/parsing/vault/__init__.py |
| high | Py Runtime Base64 Decode | base64/hex decode combined with exec/subprocess — classic obfuscated payload pattern. · ansible_core-2.16.19rc1/lib/ansible/plugins/connection/winrm.py |
| medium | Py Import Time Eval Exec | Python eval()/exec() called on a string. · ansible_core-2.16.19rc1/lib/ansible/module_utils/six/__init__.py |
| medium | Py Import Time Eval Exec | Python eval()/exec() called on a string. · ansible_core-2.16.19rc1/lib/ansible/plugins/strategy/__init__.py |
Scanned versions
| Version | Verdict | Score | Scanned (UTC) |
|---|---|---|---|
2.16.19rc1 | Review | 56 | 2026-06-11 |
2.18.18rc1 | Review | 56 | 2026-06-11 |
2.19.11rc1 | Review | 56 | 2026-06-11 |
2.20.7rc1 | Review | 56 | 2026-06-11 |
2.21.1rc1 | Review | 56 | 2026-06-11 |
Block this in CI
pkgradar gate --ecosystem pypi ansible-core==2.16.19rc1