CVE-2026-44190: Ansible Lightspeed VSCode RCE Vulnerability

CVE-2026-44190 Overview

CVE-2026-44190 is a command injection vulnerability [CWE-78] in the Ansible Lightspeed Visual Studio Code extension. The flaw resides in the handling of the ansible.python.activationScript setting, which fails to validate user-supplied input as a file path. An attacker can craft a malicious project that, when opened or executed by a targeted user, triggers execution of arbitrary commands with the privileges of the Visual Studio Code process.

Critical Impact
Successful exploitation grants complete control over the user's system in the security context of the Visual Studio Code application, enabling code execution, data theft, and lateral movement.

Affected Products

Ansible Lightspeed Visual Studio Code extension
Red Hat distributions bundling the affected extension
Developer workstations running vulnerable versions of the extension

Discovery Timeline

2026-07-22 - CVE-2026-44190 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-44190

Vulnerability Analysis

The Ansible Lightspeed extension exposes a configuration setting named ansible.python.activationScript. This setting is intended to reference a virtual environment activation script used when invoking Python-based Ansible tooling from within Visual Studio Code. The extension consumes this value and passes it to a shell execution path without validating that the input represents a legitimate file path.

Because Visual Studio Code honors workspace-scoped settings stored in .vscode/settings.json, a project cloned from an untrusted source can carry an attacker-controlled value for ansible.python.activationScript. When the extension activates or the user triggers an Ansible action, the malicious string is interpreted by the shell, producing arbitrary command execution.

Exploitation requires user interaction to open the crafted project. Once executed, commands run with the privileges of the Visual Studio Code process, which typically matches the interactive user.

Root Cause

The root cause is improper neutralization of special elements used in an operating system command [CWE-78]. The extension treats a configuration string as trusted input and concatenates it into a shell invocation instead of validating that the value points to an existing script and quoting or escaping shell metacharacters.

Attack Vector

The attack vector is local and requires user interaction. An attacker publishes or distributes an Ansible project containing a poisoned workspace configuration. When a developer opens the repository in Visual Studio Code with the Ansible Lightspeed extension installed, the injected command executes without further prompting. See the Red Hat CVE-2026-44190 Advisory and Red Hat Bug 2466762 Details for vendor analysis.

Detection Methods for CVE-2026-44190

Indicators of Compromise

Presence of ansible.python.activationScript entries in .vscode/settings.json that contain shell metacharacters such as ;, &&, |, or backticks.
Unexpected child processes spawned by the Visual Studio Code process (code, Code.exe) shortly after opening an Ansible project.
Outbound network connections from Visual Studio Code to unknown hosts following workspace activation.

Detection Strategies

Scan repositories and developer endpoints for workspace settings files referencing ansible.python.activationScript with non-path values.
Alert on process lineage where code or Code.exe spawns interpreters (sh, bash, powershell.exe, cmd.exe) executing inline commands.
Correlate extension activation events with new process creation and file system writes outside the workspace directory.

Monitoring Recommendations

Enable command-line auditing on developer workstations to capture arguments passed to shell interpreters.
Monitor changes to .vscode/settings.json across source control and endpoint telemetry.
Track installations and versions of the Ansible Lightspeed extension across the developer fleet.

How to Mitigate CVE-2026-44190

Immediate Actions Required

Update the Ansible Lightspeed Visual Studio Code extension to the fixed version referenced in the Red Hat CVE-2026-44190 Advisory.
Audit existing repositories for malicious ansible.python.activationScript values before opening them in Visual Studio Code.
Disable Visual Studio Code Workspace Trust auto-approval and require explicit trust prompts for new folders.

Patch Information

Red Hat has published tracking information under Bug 2466762. Apply the vendor-provided extension update as soon as it is available in your distribution channel and confirm that the setting is validated as a file path.

Workarounds

Uninstall or disable the Ansible Lightspeed extension until a patched version is deployed.
Configure Visual Studio Code Workspace Trust to block extension activation in untrusted folders.
Enforce a policy that developers review .vscode/settings.json before opening third-party repositories.

bash

# Configuration example: locate suspicious activationScript values across repositories
grep -R --include="settings.json" "ansible.python.activationScript" /path/to/repos