What is the CVSS score of EUVD-2026-47651?

EUVD-2026-47651 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.8%.

Which versions of Ansible Lightspeed are affected by EUVD-2026-47651?

The Ansible Lightspeed extension for Visual Studio Code contains a command injection vulnerability (CVE-2026-44190) that executes arbitrary code on a developer's machine when they open a repository…

How to fix or mitigate EUVD-2026-47651?

Within 24 hours, send an urgent notice to all development teams identifying which developers have the Ansible Lightspeed extension installed in VS Code and instruct them not to open any untrusted repositories until further guidance. Within 7 days, deploy a blocking policy to disable the ansible.python.activationScript setting across all managed VS Code instances, or uninstall the Ansible Lightspeed extension entirely until a vendor patch is available; update development guidelines to prohibit opening third-party or external Ansible repositories without explicit security review. Within 30 days, establish a monitoring process for vendor advisories from Ansible/Red Hat, identify alternative Ansible development tools that do not have this vulnerability surface, and implement mandatory code review of all workspace configuration files (.vscode/settings.json, ansible configuration) before developers open new projects.

Ansible Lightspeed EUVD-2026-47651

| CVE-2026-44190 HIGH

OS Command Injection (CWE-78)

2026-07-22 secalert@redhat.com

GHSA-6hm5-xxgq-f387

Python Command Injection Red Hat

7.8

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local trigger via opening a crafted project (AV:L, UI:R), no attacker privileges needed (PR:N), and command execution yields full C/I/A impact on the user's system.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

7.8 HIGH

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 12:31 vuln.today

CVE Published

Jul 22, 2026 - 12:17 nvd

HIGH 7.8

DescriptionCVE.org

A flaw was found in the Ansible Lightspeed Visual Studio Code extension. This Command Injection vulnerability (CWE-78) allows a remote attacker to execute unauthorized commands on a user's system. The issue occurs because the ansible.python.activationScript setting, intended for a virtual environment activation script, does not properly validate user input as a file path. If a user opens or executes a specially crafted project, an attacker could exploit this to gain complete control over the user's system with the privileges of the Visual Studio Code application.

AnalysisAI

Command injection in the Ansible Lightspeed extension for Visual Studio Code lets a crafted project achieve arbitrary code execution on a developer's machine. The extension's ansible.python.activationScript setting is treated as a shell command rather than validated as a file path, so when a victim opens or runs a malicious repository, attacker-controlled content in that setting executes with the privileges of the VS Code process. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

The affected component is the Ansible Lightspeed VS Code extension (an AI-assisted authoring/companion tool for Ansible content). The extension exposes a workspace setting, ansible.python.activationScript, whose intended purpose is to point at a Python virtual-environment activation script before the extension invokes the Python interpreter. The root cause is CWE-78 (OS Command Injection): the value is passed into a shell/command context without validating that it is a legitimate file path or sanitizing shell metacharacters. Because VS Code workspace settings can be committed to a repository (.vscode/settings.json), an attacker can populate this setting in a shared project so that the string is interpreted as executable shell commands the moment the extension activates its Python environment.

Affected ProductsAI

The affected product is the Red Hat Ansible Lightspeed extension for Visual Studio Code. Exact affected and fixed version ranges are not enumerated in the provided data; no CPE string was supplied. Refer to the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-44190 and the tracking bug at https://bugzilla.redhat.com/show_bug.cgi?id=2466762 for authoritative version and fix details.

RemediationAI

Update the Ansible Lightspeed VS Code extension to the fixed version once published; consult the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-44190 and Bugzilla 2466762 (https://bugzilla.redhat.com/show_bug.cgi?id=2466762) for the exact patched build, as no specific fix version is confirmed in the available data. As compensating controls until patched: do not open untrusted Ansible/VS Code projects, and when you must, open them in VS Code Restricted Mode / Workspace Trust so workspace-level settings are not automatically honored; review any incoming .vscode/settings.json for an ansible.python.activationScript entry and remove or override it with a trusted user/global value before loading the workspace; and consider disabling the Ansible Lightspeed extension when working with unvetted repositories. The trade-off of Restricted Mode and disabling the extension is reduced functionality (language features and Lightspeed assistance) while the workspace is untrusted.