CVE-2026-44189

Name of the Vulnerable Software and Affected Versions Visual Studio Code Ansible Lightspeed extension (affected versions not specified)

Description A command injection flaw exists in the AnsiblePlaybookRunProvider. An attacker can craft a malicious playbook filename containing special characters that are not properly sanitized. When the playbook is executed, it allows for the execution of arbitrary code with the privileges of the user running VS Code, potentially leading to full system compromise, sensitive data exfiltration, modification of project files, and permanent data loss.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.