cve/2014/CVE-2014-4966.md

### [CVE-2014-4966](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4966)
![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)

### Description

Ansible before 1.6.7 does not prevent inventory data with "{{" and "lookup" substrings, and does not prevent remote data with "{{" substrings, which allows remote attackers to execute arbitrary code via (1) crafted lookup('pipe') calls or (2) crafted Jinja2 data.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/clhlc/ansible-2.0