This vulnerability (CVE-2026-44190) affects the Ansible Lightspeed extension for Visual Studio Code in Red Hat Ansible Automation Platform 2. It is an OS command injection flaw (CWE-78) caused by improper neutralization of special elements in the ansible.python.activationScript setting, which is intended to specify a virtual environment activation script path. Because the input is not properly validated, a remote attacker can execute unauthorized OS commands by delivering a specially crafted project that triggers the vulnerable setting. The attack requires user interaction (opening or executing the project) and runs with the privileges of the Visual Studio Code application. The CVSS 3.1 vector indicates local attack vector with low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. The vendor advisory does not currently specify a patch or mitigation, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation allows an attacker to execute arbitrary OS commands on the user's system with the privileges of the Visual Studio Code application, potentially leading to full system compromise. The vulnerability impacts confidentiality, integrity, and availability at a high level. Exploitation requires user interaction but no prior privileges.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-44190 for current remediation guidance. Until a fix is available, users should exercise caution when opening or executing projects from untrusted sources in Visual Studio Code with the Ansible Lightspeed extension installed. No vendor-provided mitigation or workaround is currently documented.