{"action":"Upgrade ansible-vault to 1.0.5 or later.","affected":[{"fixed":"1.0.5","introduced":"0"}],"component":"ansible-vault","cve_ids":["CVE-2017-2809"],"ecosystem":"PyPI","epss":0.02991,"exploited":false,"fixed_versions":["1.0.5"],"ghsa_id":"GHSA-c2w9-48qc-qpj4","id":"tcs_01M5KG7B9QJ7S1PNE8V4EF4CPS","modified_at":"2026-06-10T17:00:10.667680370Z","published_at":"2017-09-14T19:29:00Z","references":["https://osv.dev/vulnerability/PYSEC-2017-5","https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0305","https://github.com/tomoh1r/ansible-vault/issues/4","https://github.com/tomoh1r/ansible-vault/commit/3f8f659ef443ab870bb19f95d43543470168ae04","https://github.com/tomoh1r/ansible-vault/blob/v1.0.5/CHANGES.txt","http://www.securityfocus.com/bid/100824","https://github.com/advisories/GHSA-c2w9-48qc-qpj4"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2017-5","url":"https://osv.dev/vulnerability/PYSEC-2017-5"}],"summary":"An exploitable vulnerability exists in the yaml loading functionality of ansible-vault before 1.0.5. A specially crafted vault can execute arbitrary python commands resulting in command execution. An"}