Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2026-44189: Visual Studio Code Ansible Lightspeed Extension: Malicious Playbook File Risk
CVE-2026-44189 · published 3 months ago
Summary
The Visual Studio Code Ansible Lightspeed extension is vulnerable to a security risk that could allow an attacker to run malicious code with your user privileges. This could lead to serious consequences, including data theft, project file modification, and permanent data loss. To stay safe, update the extension to the latest version or consider disabling it until the issue is resolved.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| red hat | red hat ansible automation platform 2 | All versions |
Original advisory text
A flaw was found in the Visual Studio Code Ansible Lightspeed extension's AnsiblePlaybookRunProvider. This command injection vulnerability allows an attacker to craft a malicious playbook filename ...
A flaw was found in the Visual Studio Code Ansible Lightspeed extension's AnsiblePlaybookRunProvider. This command injection vulnerability allows an attacker to craft a malicious playbook filename containing special characters. When a victim runs the playbook, these characters are not properly sanitized, leading to the execution of arbitrary code with the privileges of the user running VS Code. This could result in a full system compromise, including the exfiltration of sensitive data, modification of project files, and permanent data loss.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Timeline
Published22 Jul 2026
Updated3 Nov 2026
First seen22 Jul 2026
Track software like this
Free during beta