EUVD-2026-47655
GHSA-63fx-4hcp-68gg
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attacker needs no account (payload delivered via workspace, PR:N) but victim must open the malicious project locally (AV:L, UI:R); full C/I/A as arbitrary code runs with the user's privileges (S:U).
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in the Visual Studio Code Ansible Lightspeed extension. This command injection vulnerability (CWE-78) arises from improper handling of the ansible.executionEnvironment.containerOptions and ansible.executionEnvironment.volumeMounts settings, allowing an attacker to inject shell separators. This can be triggered automatically during Language Server initialization or manually when executing a playbook. Successful exploitation leads to remote code execution (RCE) on the victim's machine with the privileges of the Visual Studio Code user, potentially resulting in a complete system compromise.
AnalysisAI
Local code execution in the Visual Studio Code Ansible (Lightspeed) extension lets a malicious project run arbitrary shell commands on a developer's machine by abusing the ansible.executionEnvironment.containerOptions and volumeMounts settings, which fail to sanitize shell separators (CWE-78). Because these are workspace-scoped settings, simply opening a booby-trapped repository can auto-trigger execution during Language Server initialization, yielding code execution as the VS Code user. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV; CVSS is 7.8 (High).
Technical ContextAI
The vulnerable component is Red Hat's Ansible extension for Visual Studio Code, which integrates the Ansible Language Server and the Lightspeed AI assistant. To run playbooks inside container-based 'execution environments', the extension reads the ansible.executionEnvironment.containerOptions and ansible.executionEnvironment.volumeMounts configuration values and passes them into a container runtime command line (e.g., podman/docker invocation). The root cause is CWE-78 (OS Command Injection): user/workspace-supplied option strings are concatenated into a shell command without neutralizing metacharacters such as ; | && $() , so an attacker who controls those settings can append additional shell commands. Because VS Code honors workspace-level settings (.vscode/settings.json), the attacker-controlled value travels with a repository rather than requiring access to the victim's global config. The CPE data maps this to Red Hat Ansible Automation Platform 2 packaging (cpe:2.3:a:red_hat:red_hat_ansible_automation_platform_2), reflecting Red Hat's distribution of the extension/language server component.
RemediationAI
Update the Visual Studio Code Ansible/Ansible Lightspeed extension to the fixed release once available and monitor the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-44191 and Bugzilla https://bugzilla.redhat.com/show_bug.cgi?id=2466761 for the exact patched version, which is not stated in the available data (no vendor-released fix version independently confirmed). As compensating controls until patched: avoid opening untrusted Ansible repositories in VS Code, and use VS Code Workspace Trust / Restricted Mode so that workspace-supplied settings are not applied automatically (trade-off: some language features are disabled in untrusted folders). Explicitly review or strip ansible.executionEnvironment.containerOptions and ansible.executionEnvironment.volumeMounts from any cloned project's .vscode/settings.json before trusting it, and where execution environments are not needed, disable the execution-environment feature entirely (trade-off: loss of containerized playbook runs). Pin trusted configuration at the user/global scope and prevent workspace overrides where the editor supports it.
Credential disclosure in Red Hat Ansible Automation Platform 2.5 and 2.6 allows any authenticated user to retrieve plain
Server-side request forgery in the Red Hat Ansible Automation Platform 2 Controller's HashiCorp Vault credential plugin
Arbitrary file write in pulpcore's FilesystemExport feature allows an authenticated administrator to escape the intended
mTLS authentication bypass in the Red Hat Ansible Automation Platform (AAP) Gateway Envoy proxy allows unauthenticated r
Arbitrary command execution in ansible-core allows an attacker who controls a collection source URI to run commands on a
Credential exfiltration via SSRF in AWX's GitHub webhook status callback affects Red Hat Ansible Automation Platform 2:
SSRF vulnerabilities in AWX notification backends (webhook, Mattermost, Rocket.Chat, and Grafana) allow an authenticated
Remote code execution in galaxy_ng's legacy role import API (v1) allows an authenticated user controlling a git reposito
Path traversal in AWX's project_archive action plugin allows arbitrary file writes to execution node filesystems outside
Incomplete RBAC authorization in AWX's websocket event consumer exposes real-time job stdout to any authenticated user,
Server-side request forgery in galaxy_ng, the Ansible Galaxy server plugin for Pulp, allows authenticated users holding
Container privilege escalation in Red Hat Ansible Automation Platform 2 allows non-root users within affected container
Same weakness CWE-78 – OS Command Injection
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today