CVE-2026-44191 Red Hat CVE debrief

Who should care

Users of Visual Studio Code with the Ansible Lightspeed extension installed should be aware of this vulnerability and take immediate action to mitigate the risk. Affected operators and platforms should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Vulnerability management and security teams should prioritize this vulnerability due to its high severity and potential impact on the system.

Technical summary

The Visual Studio Code Ansible Lightspeed extension is vulnerable to a command injection attack due to improper handling of the ansible.executionEnvironment.containerOptions and ansible.executionEnvironment.volumeMounts settings, allowing an attacker to inject shell separators. This can be triggered automatically during Language Server initialization or manually when executing a playbook. Successful exploitation leads to remote code execution (RCE) on the victim's machine with the privileges of the Visual Studio Code user, potentially resulting in a complete system compromise. The vulnerability has a CVSS score of 7.8 and is classified as HIGH severity.

Defensive priority

High

Recommended defensive actions

• Update the Visual Studio Code Ansible Lightspeed extension to the latest version
• Restrict access to the Visual Studio Code instance
• Monitor for suspicious activity
• Implement additional security measures such as SELinux or AppArmor
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-22T13:16:37.367Z and has not been modified since then. The NVD entry is currently Awaiting Analysis. There is limited information available about the vulnerability, and defenders should verify the affected scope and severity with the vendor. The Visual Studio Code Ansible Lightspeed extension is vulnerable to a command injection attack due to improper handling of certain settings.

Official resources