What is the CVSS score of CVE-2026-44189?

CVE-2026-44189 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.0%.

Which versions of Ansible Lightspeed are affected by CVE-2026-44189?

The Ansible Lightspeed extension for Visual Studio Code is vulnerable to arbitrary code execution when developers open projects with specially-crafted playbook filenames, creating a supply-chain risk…

How to fix or mitigate CVE-2026-44189?

Within 24 hours, audit your organization for VS Code installations with the Ansible Lightspeed extension enabled and disable the extension or restrict playbook execution until a patch is available. Over the next 7 days, review recent Ansible playbook repositories and commits for suspicious filenames containing shell metacharacters, and enable endpoint logging on affected developer workstations. Within 30 days, establish a process to monitor vendor security advisories for a patched version and prepare a deployment plan for immediate rollout once available.

Ansible Lightspeed CVE-2026-44189

EUVD-2026-47650 HIGH

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (CWE-88)

2026-07-22 secalert@redhat.com

GHSA-qqc6-9wv9-jxfp

RCE Information Disclosure Command Injection Red Hat

7.8

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local delivery via a malicious playbook file (AV:L) with no target privileges (PR:N) but mandatory victim action to run it (UI:R); code runs as the user, fully impacting C/I/A.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

7.8 HIGH

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 12:31 vuln.today

CVE Published

Jul 22, 2026 - 12:17 nvd

HIGH 7.8

DescriptionCVE.org

A flaw was found in the Visual Studio Code Ansible Lightspeed extension's AnsiblePlaybookRunProvider. This command injection vulnerability allows an attacker to craft a malicious playbook filename containing special characters. When a victim runs the playbook, these characters are not properly sanitized, leading to the execution of arbitrary code with the privileges of the user running VS Code. This could result in a full system compromise, including the exfiltration of sensitive data, modification of project files, and permanent data loss.

AnalysisAI

Arbitrary code execution in the Visual Studio Code Ansible Lightspeed extension lets an attacker embed shell metacharacters in an Ansible playbook filename that the AnsiblePlaybookRunProvider passes unsanitized to a command invocation. When a developer opens the malicious project and runs the playbook, the injected characters execute arbitrary commands with the privileges of the VS Code user. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the local high-impact profile (CVSS 7.8, C:H/I:H/A:H) makes it a meaningful supply-chain/repository-poisoning risk for Ansible developers.

Technical ContextAI

The vulnerability lives in the AnsiblePlaybookRunProvider component of the Ansible Lightspeed extension for VS Code, which orchestrates running Ansible playbooks from the editor. Root cause is CWE-88 (Improper Neutralization of Argument Delimiters in a Command / argument injection): the provider constructs a command line to invoke the ansible-playbook runner using the playbook's filename, but fails to escape or neutralize special/shell metacharacters in that filename. Because the filename becomes part of a command string rather than being passed as a safely quoted argument, an attacker-controlled name can break out of the intended argument and inject additional commands or arguments that the underlying shell or process executor then runs. No CPE strings were provided in the source data, so exact affected extension versions are not enumerated in the input.

Affected ProductsAI

The affected product is the Ansible Lightspeed extension for Visual Studio Code, specifically its AnsiblePlaybookRunProvider component. The provided intelligence does not include CPE strings or an explicit affected version range, so precise vulnerable versions cannot be confirmed from the input alone; consult the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-44189 and the tracking bug at https://bugzilla.redhat.com/show_bug.cgi?id=2466763 for the authoritative version list. The vulnerability was reported by Red Hat Product Security (secalert@redhat.com).

RemediationAI

No vendor-released patch version is identified in the supplied data, so the primary action is to consult the Red Hat advisory (https://access.redhat.com/security/cve/CVE-2026-44189) and Bugzilla tracker (https://bugzilla.redhat.com/show_bug.cgi?id=2466763) for the fixed extension release and upgrade the Ansible Lightspeed extension to it as soon as it is published. Until a fixed version is applied, the most effective compensating control is to avoid opening or running Ansible playbooks from untrusted or externally-sourced repositories in VS Code, since the trigger is a malicious filename in a cloned project; developers should also inspect playbook filenames for shell metacharacters (semicolons, backticks, $(), pipes, ampersands) before invoking the run action, and disable or refrain from using the 'run playbook' feature of the extension on untrusted workspaces - the trade-off being loss of one-click playbook execution convenience. Using VS Code Restricted Mode / Workspace Trust for unfamiliar folders further limits accidental execution.