plugins/cache/memcached.py documents "JSON formatted" records (line 13) but
  imports neither json nor pickle and does no explicit (de)serialization. set()
  passes the Ansible facts dict directly to python-memcached with
  min_compress_len=1 (lines 214-217); get() returns the client result unchanged
  (lines 201-212). python-memcached auto-pickles non-str/int values
  (_FLAG_PICKLE) and, with min_compress_len set, compresses them
  (_FLAG_COMPRESSED) -> stored flags 9, and calls pickle.loads() on read. The
  sibling plugins/cache/redis.py uses explicit AnsibleJSONEncoder/Decoder
  (lines 189, 194). memcached has no authentication and the key is
  "ansible_facts<host>" (default prefix, lines 31/193-194), so an attacker with
  network reach to the memcached instance can poison a fact-cache entry that the
  controller unpickles on the next read, yielding code execution as the ansible
  user.
    Upstream:        https://github.com/ansible-collections/community.general
                     plugins/cache/memcached.py — UNFIXED (no PR; no public CVE)
    Affected file:   plugins/cache/memcached.py (:13 docstring, :201-217 get/set)