{"action":"Upgrade ansible to 1.6.7 or later.","affected":[{"fixed":"1.6.7","introduced":"0"}],"component":"ansible","cve_ids":["CVE-2014-4966"],"ecosystem":"PyPI","epss":0.0355,"exploited":false,"fixed_versions":["1.6.7"],"ghsa_id":"GHSA-wqq5-c89p-3wc3","id":"tcs_01M5KG9RWPY67MC6SES693RVSX","modified_at":"2026-06-10T17:00:20.747861095Z","published_at":"2020-02-18T15:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2020-204","https://github.com/ansible/ansible/commit/62a1295a3e08cb6c3e9f1b2a1e6e5dcaeab32527","http://www.ocert.org/advisories/ocert-2014-004.html","https://github.com/advisories/GHSA-wqq5-c89p-3wc3"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2020-204","url":"https://osv.dev/vulnerability/PYSEC-2020-204"}],"summary":"Ansible before 1.6.7 does not prevent inventory data with \"{{\" and \"lookup\" substrings, and does not prevent remote data with \"{{\" substrings, which allows remote attackers to execute arbitrary code v"}