Description
A flaw was found in the Visual Studio Code Ansible Lightspeed extension. This command injection vulnerability (CWE-78) arises from improper handling of the ansible.executionEnvironment.containerOptions and ansible.executionEnvironment.volumeMounts settings, allowing an attacker to inject shell separators. This can be triggered automatically during Language Server initialization or manually when executing a playbook. Successful exploitation leads to remote code execution (RCE) on the victim's machine with the privileges of the Visual Studio Code user, potentially resulting in a complete system compromise.
Published: 2026-07-22
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in the Visual Studio Code Ansible Lightspeed extension and allows an attacker to inject shell separators through the ansible.executionEnvironment.containerOptions and ansible.executionEnvironment.volumeMounts settings. This injection results in remote code execution with the privileges of the VS Code user, potentially giving the attacker full control of the victim machine. The weakness is a classic command injection flaw (CWE-78).

Affected Systems

The affected product is Red Hat Ansible Automation Platform 2, via the VS Code Ansible Lightspeed extension bundled with that platform. No specific version range is listed, but all releases of the 2.x platform that include the unpatched extension are vulnerable.

Risk and Exploitability

The CVSS score of 7.8 indicates a high severity. The EPSS score is less than 1%, and the vulnerability is not currently listed in CISA’s KEV catalog. It is likely exploitable during Language Server initialization or when executing a playbook, meaning the attack could be automated or triggered by enticing a user to open a malicious workspace or run a malicious playbook from an unverified source.

Generated by OpenCVE AI on August 3, 2026 at 23:52 UTC.

Remediation

Vendor Workaround

To mitigate this issue, users of the Visual Studio Code Ansible Lightspeed extension should exercise caution and avoid opening untrusted workspaces or executing playbooks from unverified sources. Carefully review the contents of `ansible.executionEnvironment.containerOptions` and `ansible.executionEnvironment.volumeMounts` settings within the extension's configuration, especially when dealing with new or external projects, to prevent the injection of malicious commands.

OpenCVE Recommended Actions

  • Update the Ansible Lightspeed extension to the latest patched version from the Visual Studio Code marketplace.
  • Review and sanitize the ansible.executionEnvironment.containerOptions and ansible.executionEnvironment.volumeMounts settings, ensuring no shell separators are present.
  • Exercise caution when opening workspaces or running playbooks from untrusted or external sources, and review the ansible.executionEnvironment.containerOptions and volumeMounts settings for malicious content to prevent injection.
  • Avoid opening workspaces or running playbooks from untrusted or external sources until the extension is fully updated or the settings are verified safe.
  • As a temporary measure, disable the extension or remove the containerOptions and volumeMounts configuration until an official patch is released.

Generated by OpenCVE AI on August 3, 2026 at 23:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 23 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Wed, 22 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 22 Jul 2026 13:00:00 +0000

Type Values Removed Values Added
Description A flaw was found in the Visual Studio Code Ansible Lightspeed extension. This command injection vulnerability (CWE-78) arises from improper handling of the ansible.executionEnvironment.containerOptions and ansible.executionEnvironment.volumeMounts settings, allowing an attacker to inject shell separators. This can be triggered automatically during Language Server initialization or manually when executing a playbook. Successful exploitation leads to remote code execution (RCE) on the victim's machine with the privileges of the Visual Studio Code user, potentially resulting in a complete system compromise.
Title Ansible-lightspeed: visual studio code ansible lightspeed extension: remote code execution via command injection in configuration settings
First Time appeared Redhat
Redhat ansible Automation Platform
Weaknesses CWE-78
CPEs cpe:/a:redhat:ansible_automation_platform:2
Vendors & Products Redhat
Redhat ansible Automation Platform
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Redhat Ansible Automation Platform
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-07-22T18:48:19.980Z

Reserved: 2026-05-05T15:02:54.444Z

Link: CVE-2026-44191

cve-icon Vulnrichment

Updated: 2026-07-22T18:30:56.713Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-07-22T13:16:37.367

Modified: 2026-07-22T19:17:03.743

Link: CVE-2026-44191

cve-icon Redhat

Severity : Important

Publid Date: 2026-07-22T12:06:44Z

Links: CVE-2026-44191 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T00:00:09Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')