CVE-2026-44190
HighCVSS 7.8Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
The Ansible Lightspeed extension for Visual Studio Code contains a command injection vulnerability (CWE-78). The `ansible.python.activationScript` setting does not properly validate the file path, allowing a remote attacker to execute unauthorized commands on the user's system when a crafted project is opened.
Risk Assessment
An attacker can gain full control over the victim's system with the privileges of Visual Studio Code, potentially leading to data theft or further attacks.
Recommendation
Update the Ansible Lightspeed extension to the latest patched version.
Other vulnerabilities in Ansible Lightspeed
See all- CVE-2026-44187Low
The Ansible Lightspeed extension for Visual Studio Code stores the Google Gemini API key in plain text in the user's configuration file and writes it to log files. A local attacker or malware with user privileges can read this key.
- CVE-2026-44188Medium
A flaw was found in Ansible Lightspeed related to insufficient session expiration. A remote attacker can maintain persistent access to the Ansible Lightspeed instance if they exfiltrate a valid OAuth access token before a user logs out. The application fails to invalidate the token on the backend, leaving it valid until its natural expiration.
Original NVD description (English source)
A flaw was found in the Ansible Lightspeed Visual Studio Code extension. This Command Injection vulnerability (CWE-78) allows a remote attacker to execute unauthorized commands on a user's system. The issue occurs because the `ansible.python.activationScript` setting, intended for a virtual environment activation script, does not properly validate user input as a file path. If a user opens or executes a specially crafted project, an attacker could exploit this to gain complete control over the user's system with the privileges of the Visual Studio Code application.