CVE-2026-44190

Name of the Vulnerable Software and Affected Versions Ansible Lightspeed Visual Studio Code extension (affected versions not specified)

Description A command injection flaw exists where the extension fails to properly validate user input as a file path within the ansible.python.activationScript setting. This setting is intended for virtual environment activation scripts. A remote attacker can exploit this by inducing a user to open or execute a specially crafted project, allowing the execution of unauthorized commands with the privileges of the Visual Studio Code application.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.