What’s Vulnerable › Vulnerabilities

CVE-2026-44190: Ansible-lightspeed: ansible lightspeed visual studio code extension: arbitrary code execution via command injection in activation script setting

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-22 · updated 2026-10-24
• Weakness: CWE-78

Description

A flaw was found in the Ansible Lightspeed Visual Studio Code extension. This Command Injection vulnerability (CWE-78) allows a remote attacker to execute unauthorized commands on a user's system. The issue occurs because the `ansible.python.activationScript` setting, intended for a virtual environment activation script, does not properly validate user input as a file path. If a user opens or executes a specially crafted project, an attacker could exploit this to gain complete control over the user's system with the privileges of the Visual Studio Code application.

Affected products

• Red Hat Ansible Automation Platform 2: all versions

References

• https://access.redhat.com/security/cve/CVE-2026-44190
• https://bugzilla.redhat.com/show_bug.cgi?id=2466762

Get alerted when CVE-2026-44190 or the next vulnerability affects your stack