This vulnerability involves improper neutralization of argument delimiters in a command within the AnsiblePlaybookRunProvider of the Visual Studio Code Ansible Lightspeed extension. An attacker can craft a malicious playbook filename with special characters that are not sanitized, resulting in command injection when the playbook is executed. The exploit allows arbitrary code execution with the user's privileges, potentially compromising the entire system and sensitive data. The CVSS 3.1 base score is 7.8, reflecting high severity with local attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the user running Visual Studio Code. This can lead to full system compromise, including exfiltration of sensitive data, unauthorized modification of project files, and permanent data loss. The vulnerability requires the victim to run a maliciously named playbook, involving user interaction.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-44189 for current remediation guidance. No official fix or workaround is explicitly stated in the provided advisory content. Until a patch is available, users should avoid opening or running playbooks from untrusted sources and exercise caution with filenames containing special characters in the Ansible Lightspeed extension.