# CVE-2026-44189: Red Hat Ansible Lightspeed extension command injection in AnsiblePlaybookRunProvider

Source: https://junglewise.ai/threats/cve-2026-44189-red-hat-ansible-lightspeed-extension-command-injection-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-22. Updated: 2026-07-22  
License: CC BY 4.0 with a link back

CVE-2026-44189 · Severity: high · CVSS 7.8 · Published 2026-07-22

A security vulnerability exists in the Ansible Lightspeed extension for Visual Studio Code, a tool used by developers to automate IT tasks. An attacker can create a specially crafted file that, when opened or run by a user, executes malicious commands on the user's computer. This could allow an attacker to steal sensitive data, modify project files, or gain full control over the affected system.

Technologies: [Red Hat Ansible Lightspeed extension for Visual Studio Code](https://junglewise.ai/threats/technologies/ansible-lightspeed-extension-for-visual-studio-code). Vendors: [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-44189 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44189 being exploited in the wild.

**How severe is CVE-2026-44189?** High severity, with a CVSS score of 7.8, published 22 July 2026.

**Which products and versions are affected?** Red Hat Ansible Lightspeed extension for Visual Studio Code Ansible Automation Platform 2.

**Is there a fix for CVE-2026-44189?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-44189 attacked?** It is attacked with local access, in a web application.

**Am I affected by CVE-2026-44189?** Check whether you run Red Hat Ansible Lightspeed extension for Visual Studio Code at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A command injection vulnerability (CWE-88) exists in the AnsiblePlaybookRunProvider component of the Visual Studio Code Ansible Lightspeed extension. The flaw stems from improper neutralization of special characters within playbook filenames. An attacker can exploit this by tricking a user into running a playbook with a maliciously crafted filename. Because the filename is not properly sanitized before being processed by the underlying system shell, the injected characters are executed as commands with the privileges of the VS Code user. This requires user interaction (opening/running the file) but no prior authentication on the victim's machine.

## Affected products

- Red Hat Ansible Lightspeed extension for Visual Studio Code Ansible Automation Platform 2

## Timeline

- 2026-05-05: disclosed: Initial report in Red Hat Bugzilla
- 2026-07-22: advisory: NVD publication date

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-44189](https://access.redhat.com/security/cve/CVE-2026-44189)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2466763](https://bugzilla.redhat.com/show_bug.cgi?id=2466763)

## Related threats

- [Red Hat Ansible Lightspeed extension command injection in VS Code](https://junglewise.ai/threats/cve-2026-44191-red-hat-ansible-lightspeed-extension-command-injection-in-vs-code)
- [Red Hat Ansible Lightspeed plaintext API key storage in VS Code extension](https://junglewise.ai/threats/cve-2026-44187-red-hat-ansible-lightspeed-plaintext-api-key-storage-in-vs-code)