Ansible Lightspeed vulnerabilities

The Ansible Lightspeed extension for Visual Studio Code stores the Google Gemini API key in plain text in the user's configuration file and writes it to log files. A local attacker or malware with user privileges can read this key.

The Ansible Lightspeed extension for Visual Studio Code contains a command injection vulnerability (CWE-78). The `ansible.python.activationScript` setting does not properly validate the file path, allowing a remote attacker to execute unauthorized commands on the user's system when a crafted project is opened.

A flaw was found in Ansible Lightspeed related to insufficient session expiration. A remote attacker can maintain persistent access to the Ansible Lightspeed instance if they exfiltrate a valid OAuth access token before a user logs out. The application fails to invalidate the token on the backend, leaving it valid until its natural expiration.