CVE-2026-44189

The record

A flaw was found in the Visual Studio Code Ansible Lightspeed extension's AnsiblePlaybookRunProvider. This command injection vulnerability allows an attacker to craft a malicious playbook filename containing special characters. When a victim runs the playbook, these characters are not properly sanitized, leading to the execution of arbitrary code with the privileges of the user running VS Code. This could result in a full system compromise, including the exfiltration of sensitive data, modification of project files, and permanent data loss.

Affected packages

Related vulnerabilities

• CVE-2026-62968 Dream Displays provides in-game screens for streaming videos in Minecraft. CWE-88
• CVE-2026-116252 pgAdmin 4's materialized view refresh passed the target database's name to psql's… CWE-88
• CVE-2026-111504 Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization… CWE-88
• CVE-2026-119282 Nx is a monorepo solution for TypeScript and polyglot codebases. CWE-88
• CVE-2026-90868 An OS command injection vulnerability in Progress Software WS_FTP Server versions prior… CWE-88
• CVE-2026-90865 An OS command injection vulnerability in Progress Software WS_FTP Server versions prior… CWE-88
• CVE-2026-50056 A local privilege escalation vulnerability in the zmmailboxdmgr launcher of Zimbra… CWE-88
• CVE-2026-115372 Incus from 7.3.0 before 7.5.0 contains a project restriction bypass that allows… CWE-88