CVE-2026-16493

Name of the Vulnerable Software and Affected Versions ansible-core (affected versions not specified)

Description An issue exists in the extract collection from git() function within concrete artifact manager.py where git clone commands are constructed without an end-of-options separator before user-supplied URLs. This allows an attacker to provide a crafted collection source URI containing git argument injection payloads, leading to arbitrary command execution when a user executes the ansible-galaxy collection install command with the malicious source.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.