My Ansible Plugin Had a Jail Escape: CVE-2026-55074

Said it before but will say it again, if you are using REGEX for validation you can nearly always be sure this shortcut is broken.

Regexp are nearly always broken for validation because they dont capture the context of the operation, in this case the text is checked as text and ignores other aspects of a path such as links etc.