CVE-2026-12398
CVE-2026-12398 · Galaxy_ng: shell injection in legacy role import via unsanitized git ref names
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A command injection vulnerability was found in galaxy_ng. The do_git_checkout() function in the legacy role import API (v1) interpolates unsanitized git ref names (branch/tag names) into shell commands executed via subprocess.run() with shell=True. An authenticated user who controls a git repository can create a branch or tag with shell metacharacters in the name to achieve remote code execution on the pulp worker. The vulnerable endpoint is only reachable when GALAXY_ENABLE_LEGACY_ROLES is set to True, which is not the default configuration.
CVSS 7.5 · High · EPSS 0.9%
- Published
- Updated
Stack: python
Affected products and versions
red hat ansible automation platform 2
No fix published
red hat ansible automation platform 2
No fix published
red hat ansible automation platform 2
No fix published
galaxy-ng PyPI
- Versions
- 4.2.0
- 4.2.0a10
- 4.2.0a12
- 4.2.0a3
- 4.2.0a4
- 4.2.0a5
- 4.2.0a6
- 4.2.0a7
- 4.2.0a8
- 4.2.0a9
- 4.2.0b1
- 4.2.0b2
- 4.2.0b3
- 4.2.0rc1
- 4.2.0rc2
- 4.2.0rc3
- 4.2.1
- 4.2.2
- 4.2.3
- 4.2.3b1
- 4.2.4
- 4.2.5
- 4.2.6
- 4.2.7
- 4.2.8
- 4.3.0
- 4.3.0a1
- 4.3.0a2
- 4.3.0b4
- 4.3.1
- 4.3.2
- 4.3.3
- 4.3.4
- 4.3.5
- 4.4.0
- 4.4.0a1
- 4.4.0a2
- 4.4.0b1
- 4.4.0b2
- 4.4.1
- 4.4.2
- 4.4.3
- 4.4.4
- 4.4.5
- 4.5.0
- 4.5.0b1
- 4.5.1
- 4.5.2
- 4.5.3
- 4.5.4
- 4.5.5
- 4.6.0
- 4.6.1
- 4.6.2
- 4.6.3
- 4.6.4
- 4.6.5
- 4.6.6
- 4.7.0
- 4.7.1
- 4.7.2
- 4.7.3
- 4.8.0
- 4.8.1
- 4.9.0
- 4.9.1
- 4.9.2
- Affected ranges
- ECOSYSTEM: ≤ 4.9.2
No fix published