SB2026083170 - Multiple vulnerabilities in Ansible Automation Platform 2.2 packages
Published: August 31, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 11 vulnerabilities.
1) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-13149)
CWE-ID: CWE-407 - Inefficient Algorithmic Complexity
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to inefficient algorithmic complexity in expand() when processing attacker-influenced brace expansion patterns containing consecutive non-expanding {} groups. A remote attacker can send a specially crafted input string to cause a denial of service.
The issue can block the calling thread for minutes or indefinitely with a small all-ASCII input, and applications using Node's single-threaded event loop may fully stall a worker or process.
2) Interpretation Conflict (CVE-ID: CVE-2026-13676)
CWE-ID: CWE-436 - Interpretation Conflict
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to modify data on the system.
The vulnerability exists due to fast-uri fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize() and equal() still return values that differ from a WHATWG-compatible URL parser. A remote attacker can trigger the vulnerability to modify data on the system.
3) Uncontrolled Recursion (CVE-ID: CVE-2026-44289)
CWE-ID: CWE-674 - Uncontrolled Recursion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled recursion in the protobuf decoder when decoding nested protobuf binary data. A remote attacker can send a specially crafted protobuf binary payload to cause a denial of service.
This affects applications that decode untrusted protobuf binary input, including decoder paths that skip unknown group fields or decode nested message fields.
4) Prototype pollution (CVE-ID: CVE-2026-44290)
CWE-ID: CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper control of prototype-based property paths in protobufjs reflection APIs when parsing attacker-controlled protobuf schemas or JSON descriptors. A remote attacker can provide a specially crafted schema or descriptor to cause a denial of service.
Applications that only decode untrusted protobuf message payloads using bundled, generated, or otherwise trusted schemas are not directly affected.
5) Code Injection (CVE-ID: CVE-2026-44291)
CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary JavaScript code.
The vulnerability exists due to improper control of code generation in generated encode and decode functions when processing internal type lookup tables after Object.prototype has been polluted. A remote attacker can influence inherited properties used as protobuf type information to execute arbitrary JavaScript code.
Exploitation requires a separate prototype pollution primitive to pollute Object.prototype before the affected code generation path is reached.
6) Prototype pollution (CVE-ID: CVE-2026-44292)
CWE-ID: CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to modify the prototype chain of a message instance.
The vulnerability exists due to improperly controlled modification of object prototype attributes in generated message constructors when copying enumerable properties from an attacker-controlled plain object. A remote attacker can supply an object containing an own enumerable __proto__ property to modify the prototype chain of a message instance.
This is a per-instance prototype injection issue and does not affect Object.prototype or other global prototypes.
7) Uncontrolled Recursion (CVE-ID: CVE-2026-45740)
CWE-ID: CWE-674 - Uncontrolled Recursion
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled recursion in Root.fromJSON() and Namespace.addJSON() when processing crafted JSON descriptors with deeply nested namespace definitions. A remote attacker can provide a specially crafted JSON descriptor to cause a denial of service.
This affects applications that load JSON descriptors from untrusted sources.
8) Inefficient regular expression complexity (CVE-ID: CVE-2026-48801)
CWE-ID: CWE-1333 - Inefficient Regular Expression Complexity
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to inefficient regular expression complexity in LinkifyIt.prototype.match when processing user-supplied text containing many fuzzy links or email-like strings. A remote attacker can send a specially crafted request body to cause a denial of service.
This affects services that synchronously render untrusted Markdown with linkification enabled on the request path, including transitive use through markdown-it with linkify:true.
9) Cross-site scripting (CVE-ID: CVE-2026-49978)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote attacker to execute arbitrary script in the victim's browser.
The vulnerability exists due to cross-site scripting in template content sanitization when processing HTML containing a template element with an attached shadow root inside template.content. A remote attacker can supply crafted HTML that survives sanitization to execute arbitrary script in the victim's browser.
Exploitation occurs when the application clones the template and inserts the result into the page.
10) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-59873)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in the Unpack stream in src/extract.ts when extracting crafted compressed tar archives. A remote attacker can send a specially crafted archive to cause a denial of service.
The issue can exhaust disk space and CPU through decompression and parsing of highly compressible input.
11) Infinite loop (CVE-ID: CVE-2026-59874)
CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to loop with an unreachable exit condition in tar.replace() when scanning an attacker-controlled existing archive. A remote attacker can supply a specially crafted tar archive with a negative base-256 encoded entry size to cause a denial of service.
Only applications that call the replace API on an existing attacker-controlled archive are affected; plain extraction-only workflows are not affected.
Remediation
Install update from vendor's website.