CVE-2026-44189 PUBLISHED

Ansible-lightspeed: visual studio code ansible lightspeed extension: arbitrary code execution via malicious playbook filename

Assigner: redhat
Reserved: 05.05.2026 Published: 22.07.2026 Updated: 22.07.2026

A flaw was found in the Visual Studio Code Ansible Lightspeed extension's AnsiblePlaybookRunProvider. This command injection vulnerability allows an attacker to craft a malicious playbook filename containing special characters. When a victim runs the playbook, these characters are not properly sanitized, leading to the execution of arbitrary code with the privileges of the user running VS Code. This could result in a full system compromise, including the exfiltration of sensitive data, modification of project files, and permanent data loss.

Metrics

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS Score: 7.8

Product Status

Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: affected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: affected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: affected

Workarounds

To mitigate this issue, users of the Visual Studio Code Ansible Lightspeed extension should avoid running Ansible playbooks from untrusted sources or those with suspicious filenames. Always verify the origin and integrity of playbook files before execution to prevent command injection. This operational control limits exposure by preventing the processing of maliciously crafted filenames.

Credits

  • This issue was discovered by Laura Pardo (Red Hat Inc.).

References

Problem Types

  • Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') CWE