Hi,

The following vulnerability was published for ansible-runner.

CVE-2026-103754[0]:
| A flaw was found in ansible-runner. The unstream_dir() function,
| which receives and extracts a streamed zip archive on the worker
| side of the ansible-runner transmit/worker protocol, re-creates
| symbolic links from archive content without validating the link
| target and applies chmod() and utime() to an unsanitized filesystem
| path derived from the archive member name. A crafted archive
| processed by a worker that consumes attacker-influenced input can
| create files, create symbolic links, or change permissions outside
| the intended target directory, which can be leveraged toward code
| execution.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-103754
https://www.cve.org/CVERecord?id=CVE-2026-103754
[1] https://github.com/ansible/ansible-runner/pull/1550

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore