CVE-2026-44189 Details

A command injection vulnerability has been identified in the Visual Studio Code Ansible Lightspeed extension, specifically within the AnsiblePlaybookRunProvider component. This vulnerability allows an attacker to create a malicious playbook filename that includes special characters. When the playbook is executed, these characters are not adequately sanitized, which can lead to the execution of arbitrary code with the same privileges as the user running Visual Studio Code. The potential consequences of this vulnerability include a complete system compromise, exfiltration of sensitive data, unauthorized modification of project files, and permanent data loss.

Users of the Visual Studio Code Ansible Lightspeed extension should avoid executing Ansible playbooks from untrusted sources or those with suspicious filenames. It is important to verify the origin and integrity of playbook files before running them to prevent command injection. This operational control can help limit exposure by preventing the use of maliciously crafted filenames.