Code execution via fact-controlled module selection

Argument injection in Red Hat Ansible allows local users to execute code on managed nodes via attacker-controlled module-selection facts. The package.py and service.py action plugins trust ansible_facts values for pkg_mgr or service_mgr as the module name when use is omitted, including an attacker-chosen collection path. Exploitation requires control of facts before an operator runs a package or service task without use, after which the selected payload runs on the managed node.