jumpserver/jumpserver · error · Exception

Playbook contains dangerous keywords

Error message

Playbook contains dangerous keywords

What it means

Raised by check_danger_keywords when the playbook's files contain any line matching configured dangerous keywords (playbook.check_dangerous_keywords() returns hits). All matching lines are printed to the log with file/line/keyword before the exception aborts the job. Only checked for type == 'playbook'.

Source

Thrown at apps/ops/models/job.py:544

                    break
        command = self.current_job.args
        if command and set(command.split()).intersection(set(settings.SECURITY_COMMAND_BLACKLIST)):
            CommandExecutionAlert({
                "assets": self.current_job.assets.all(),
                "input": self.material,
                "risk_level": RiskLevelChoices.reject,
                "user": self.creator,
            }).publish_async()
            raise CommandInBlackListException(
                "Command is rejected by black list: {}".format(self.current_job.args))

    def check_danger_keywords(self):
        lines = self.job.playbook.check_dangerous_keywords()
        if len(lines) > 0:
            for line in lines:
                print('\033[31mThe {} line of the file \'{}\' contains the '
                      'dangerous keyword \'{}\'\033[0m'.format(line['line'], line['file'], line['keyword']))
            raise Exception("Playbook contains dangerous keywords")

    def check_assets_perms(self):
        all_permed_assets = UserPermAssetUtil(self.creator).get_all_assets()
        has_permed_assets = set(self.current_job.assets.all()) & set(all_permed_assets)

        error_assets_count = 0
        for asset in self.current_job.assets.all():
            if asset not in has_permed_assets:
                print("\033[31mAsset {}({}) has no access permission\033[0m".format(asset.name, asset.address))
                error_assets_count += 1

        if error_assets_count > 0:
            raise Exception("You do not have access rights to {} assets".format(error_assets_count))

    def check_data_masking_rules_acls(self):
        for asset in self.current_job.assets.all():
            acls = DataMaskingRule.filter_queryset(
                user=self.creator,

View on GitHub (pinned to 6ec464fabd)

Solutions

1. Check the job/task log: each offending file, line number and keyword is printed — edit the playbook to remove or rephrase those lines
2. Ask the admin whether the keyword list (settings) is too broad and should be refined
3. Upload the corrected playbook and rerun the job

hits = playbook.check_dangerous_keywords()
if hits:
    reject_upload('dangerous keywords: %s' % hits)

try:
    job.start()
except Exception as e:
    if 'dangerous keywords' in str(e): flag_playbook_for_review()

When it happens

Trigger: Starting a playbook job whose uploaded playbook files contain a configured dangerous keyword; check_assets_acls calls check_danger_keywords before execution.

Common situations: Security-hardened deployments with DANGER_KEYWORDS settings; playbooks that legitimately use flagged words (e.g. 'rm ', 'chmod 777') in shell tasks; keywords added by an admin after the playbook was written.

Related errors

• Sensitive fields must be submitted directly to Core and cann
• shell=True is not allowed in safe_run_cmd. Pass command as a
• Signature provided but public key missing
• command is rejected by ACL
• Command is rejected by black list: {}

AI-assisted analysis of jumpserver/jumpserver@6ec464fabd (2026-08-28). Data as JSON: /api/errors/04a2004297a617db. Report an issue: GitHub.