A flaw was found in ansible-core's ansible-galaxy command. When installing a role, ansible-galaxy processes a meta/requirements.yml file that lists role dependencies. The src and name fields from this file are passed as arguments to git clone via Python's Popen without a -- separator to delimit options from positional arguments. A malicious role author can craft a dependency entry where the src field contains a git configuration flag (e.g., -ccore.sshCommand=sh -c "malicious_command") and the name field provides a valid repository URL. This results in arbitrary code execution on the system of any user who installs the role. The fix is to insert -- before the positional arguments in the git clone command list.