Executive brief
A security vulnerability exists in the Ansible Lightspeed extension for Visual Studio Code, a tool used by developers to automate IT tasks. An attacker can create a specially crafted file that, when opened or run by a user, executes malicious commands on the user's computer. This could allow an attacker to steal sensitive data, modify project files, or gain full control over the affected system.
Technical details
A command injection vulnerability (CWE-88) exists in the AnsiblePlaybookRunProvider component of the Visual Studio Code Ansible Lightspeed extension. The flaw stems from improper neutralization of special characters within playbook filenames. An attacker can exploit this by tricking a user into running a playbook with a maliciously crafted filename. Because the filename is not properly sanitized before being processed by the underlying system shell, the injected characters are executed as commands with the privileges of the VS Code user. This requires user interaction (opening/running the file) but no prior authentication on the victim's machine.
Affected products
- Red Hat Ansible Lightspeed extension for Visual Studio Code Ansible Automation Platform 2
Timeline
- 2026-05-05: disclosed: Initial report in Red Hat Bugzilla
- 2026-07-22: advisory: NVD publication date