This vulnerability in Red Hat Ansible Automation Platform 2's Ansible Lightspeed Visual Studio Code extension involves improper neutralization of special elements in the ansible.python.activationScript setting, leading to OS command injection (CWE-78). An attacker can craft a malicious project that, when opened or executed by a user, allows execution of unauthorized OS commands with the same privileges as the Visual Studio Code process. The CVSS 3.1 vector indicates local attack vector with low attack complexity, no privileges required, user interaction needed, and high impact on confidentiality, integrity, and availability. No official remediation level or patch information is provided in the vendor advisory at this time.

Successful exploitation allows an attacker to execute arbitrary commands on the victim's system with the privileges of the Visual Studio Code application, potentially leading to full system compromise. The impact includes complete loss of confidentiality, integrity, and availability of the affected system. However, exploitation requires user interaction and local access to open or execute a malicious project.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-44190 for current remediation guidance. Until a fix is available, users should exercise caution when opening or executing projects from untrusted sources in Visual Studio Code with the Ansible Lightspeed extension enabled. No official fix or temporary workaround is currently documented by Red Hat.