This vulnerability exposes a command injection flaw in the Visual Studio Code Ansible Lightspeed extension’s playbook runner. A maliciously crafted playbook filename containing special characters is not sanitized, allowing an attacker to execute arbitrary commands with the privileges of the user running VS Code. The compromise can lead to full system control, data exfiltration modification, and permanent loss of project and system files.

The flaw affects the Red Hat Ansible Automation Platform version 2 and the accompanying Ansible Lightspeed extension for Visual Studio Code. Any system that has this platform and extension installed and processes playbooks with unchecked filenames is impacted.

The CVSS score of 7.8 indicates high severity, but the EPSS score of less than 1% suggests exploitation is considered unlikely at present. This vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local or compromised application context, requiring an attacker to supply a maliciously named playbook that a user then runs in VS Code. If an attacker can influence the filename that the extension processes, they can execute arbitrary shell commands with the launch‑time privileges of the VS Code process.