CVE-2026-44191 Details

A command injection vulnerability has been identified in the Visual Studio Code Ansible Lightspeed extension. This issue arises from improper management of the 'ansible.executionEnvironment.containerOptions' and 'ansible.executionEnvironment.volumeMounts' settings, which allows an attacker to inject shell separators. The vulnerability can be exploited automatically during Language Server initialization or manually while executing a playbook. Successful exploitation enables remote code execution on the victim's machine, using the privileges of the Visual Studio Code user, and could potentially lead to a complete system compromise.

Users of the Visual Studio Code Ansible Lightspeed extension should be cautious and avoid opening untrusted workspaces or executing playbooks from unverified sources. It is advisable to review the 'ansible.executionEnvironment.containerOptions' and 'ansible.executionEnvironment.volumeMounts' settings in the extension's configuration, particularly when working with new or external projects, to prevent the injection of harmful commands.