This vulnerability (CWE-78) in Red Hat Ansible Automation Platform 2's Visual Studio Code Ansible Lightspeed extension is due to improper neutralization of special elements in the ansible.executionEnvironment.containerOptions and ansible.executionEnvironment.volumeMounts settings. An attacker can inject shell command separators, enabling remote code execution on the victim's machine with user-level privileges. The vulnerability can be triggered automatically during Language Server initialization or manually during playbook execution. The CVSS 3.1 score is 7.8 (High), reflecting local attack vector, low complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation results in remote code execution on the victim's machine with the privileges of the Visual Studio Code user, potentially leading to complete system compromise at the user level. The attack requires local access and user interaction but can severely impact confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-44191 for current remediation guidance. No official fix or temporary workaround is stated in the available advisory content. Users should monitor Red Hat's advisory for updates and apply patches once available. Until then, avoid untrusted inputs in the affected settings and limit usage of the vulnerable extension where possible.