Unauthenticated code execution via unsafe expression evaluation

Code injection in Ansible before 1.5.4 allows remote attackers to execute arbitrary code by supplying crafted instructions to safe_eval. The safe_eval function passes expressions to Python eval after relying on regular expressions to reject only module method calls and import statements, leaving other executable constructs permitted. No authentication or user interaction is required, and successful exploitation runs code with the privileges of the Ansible process.