Vulnerability · Published Jun 30, 2025 · Assigned by redhat

CVE-2025-49521Event-driven-ansible: template injection via git branch and refspec in eda projects

High 8.8

In plain English

A high-severity code injection in Red Hat Ansible Automation Platform 2.5 for RHEL 8 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.6%top 51.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw was found in the EDA component of the Ansible Automation Platform, where user-supplied Git branch or refspec values are evaluated as Jinja2 templates. This vulnerability allows authenticated users to inject expressions that execute commands or access sensitive files on the EDA worker. In OpenShift, it can lead to service account token theft.

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat Ansible Automation Platform 2.5 for RHEL 8	see references
Red Hat	Red Hat Ansible Automation Platform 2.5 for RHEL 9	see references

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

RHSA-2025:9986 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2025-49521 vdb-entry, x_refsource_REDHAT
RHBZ#2370817 issue-tracking, x_refsource_REDHAT