GHSA-q752-5xf3-x24p: 
Rust vulnerability analysis and mitigation

Severity: High (CVSS 3.1 ~8.1, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N). The prerequisite is knowledge of a hook URL (token). Tokens are long and compared in constant time; the threat is a leaked URL or a compromised Alertmanager / Grafana contact point. Affected: koreograf < 0.1.0-alpha.3 (0.1.0-alpha.1 and 0.1.0-alpha.2). Patched in 0.1.0-alpha.3. CWE: CWE-94 (Improper Control of Generation of Code), CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine). Description. A public POST /hooks/{id}/{token} accepts a JSON payload. Alert fields become job extra vars (alertname, status, instance, summary, event.*). The demo playbook maps them into role variables via "{{ alertname }}" / "{{ instance }}". The shipped image has ansible-core 2.14.18. Before Ansible 2.19, values passed as --extra-vars are not marked unsafe, so Jinja expressions inside those values are evaluated when the playbook references them. Lookups and other expressions run on the controller, in local mode as the server user (root in the image). The Rust side does not evaluate the strings; the risk appears when an Ansible template or playbook consumes them. Live Jinja execution was not tried; the data flow and Ansible semantics are confirmed. Affected code.

• src/http/work.rs:569-583 – public ingest, token only
• src/hooks.rs:119-136 – event_vars
• src/jobs.rs:684 – event vars merge over hook vars
• examples/demo/site.yml:8-9 – maps webhook fields into role vars
• Image: ansible-core 2.14.18 (Dockerfile installs Debian ansible) Remediation.
• Prefer Ansible 2.19+ and mark untrusted values unsafe, or pass them through a JSON file that the playbook reads with lookup('file') + | from_json under controlled keys.
• Server-side: reject or strip Jinja meta characters ({{, {%, \x00) in webhook-derived strings, or pass them only under a nested key that role authors must deliberately unwrap.
• Document that hook-triggered playbooks must treat Alertmanager / Grafana fields as untrusted input and must not template them into modules that run on the controller.
• Update the demo role to copy the fields with | string / a non-templating path, and pin a safer ansible-core in the image when possible.
• Test: a hook delivery with a benign marker string in instance must appear literally in the report; a string that looks like a Jinja expression must not be evaluated (assert no unexpected files / no lookup side effects). Run this only in a disposable lab.

Patches

Fixed in v0.1.0-alpha.3. Ansible extra variables, including all webhook-derived values, are written to a YAML file with every string tagged !unsafe, so Ansible never evaluates them as Jinja templates, independent of the Ansible version.

Workarounds

Do not reference webhook-derived variables in templated module arguments that run on the controller, or disable webhooks until you upgrade.