CVE-2026-11332 — ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution

A flaw was found in ansible-core where the ansible-galaxy role install command unsafely processes dependency specifications in a role’s meta/requirements.yml file. A malicious role author can inject arbitrary Git configuration flags through the src field, potentially leading to arbitrary code execution on the machine of a user who installs the role.