Code execution via unrestricted safe_eval function calls

Code injection in Ansible before 1.5.4 allows remote attackers to execute Python functions through strings processed by safe_eval. The safe_eval function passed input directly to Python eval without first parsing its AST or restricting callable functions. Exploitation requires attacker-controlled content to reach this controller-side evaluation path; published scoring establishes integrity impact but not data disclosure or service interruption.