CVE-2014-4678: Debian Linux

Critical severity, CVSS 9.8. EPSS: 5.2% chance of exploitation in the next 30 days.

The safe_eval function in Ansible before 1.6.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-4657.

Affected products

• Debian Debian Linux: version 8.0 only; version 9.0 only; version 10.0 only
• Red Hat Ansible: before 1.6.4 (fixed in 1.6.4)

Published 2020-02-20. Last modified 2026-06-17.