CVE-2026-44190 Details
Description
A flaw was found in the Ansible Lightspeed Visual Studio Code extension. This Command Injection vulnerability (CWE-78) allows a remote attacker to execute unauthorized commands on a user's system. The issue occurs because the `ansible.python.activationScript` setting, intended for a virtual environment activation script, does not properly validate user input as a file path. If a user opens or executes a specially crafted project, an attacker could exploit this to gain complete control over the user's system with the privileges of the Visual Studio Code application.
A command injection vulnerability has been identified in the Ansible Lightspeed Visual Studio Code extension. This flaw allows remote attackers to execute unauthorized commands on a user's system. The vulnerability arises because the 'ansible.python.activationScript' setting, which is meant for specifying a virtual environment activation script, fails to properly validate user input as a file path. As a result, if a user opens or runs a specially crafted project, an attacker could exploit this weakness to gain full control over the user's system, using the privileges of the Visual Studio Code application.
To mitigate this vulnerability, users should configure the 'ansible.python.activationScript' setting to 'User' scope only within Visual Studio Code settings. This prevents untrusted project configurations from overriding this setting in '.vscode/settings.json'. Users are also advised to review the contents of '.vscode/settings.json' before opening or executing playbooks from untrusted sources.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2026-44190 | [email protected] | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2466762 | [email protected] |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Modified | CISA-ADP |
| Jul 22, 2026 | New CVE Received | [email protected] |