VS Code Ansible Lightspeed Command Injection via Playbook Filenames

This vulnerability is a command injection flaw in the Visual Studio Code Ansible Lightspeed extension that allows attackers to execute arbitrary code by embedding malicious special characters in playbook filenames. When a developer runs a crafted playbook, the AnsiblePlaybookRunProvider fails to sanitize these characters before passing them to system commands, resulting in code execution with the privileges of the VS Code process. This affects developers and DevOps engineers who use VS Code with the Ansible Lightspeed extension for infrastructure automation, potentially compromising their systems, credentials, and access to sensitive infrastructure and cloud environments.

While CVE-2026-44189 does not map directly to MITRE ATT&CK techniques in threat intelligence feeds, Casky's extended reasoning capabilities would identify this as an instance of Execution (T1059 - Command and Scripting Interpreter) through filename analysis and process spawning behavior. Practitioners using Casky would detect suspicious patterns such as: playbook filenames containing shell metacharacters (pipes, semicolons, backticks), unexpected child processes spawned from VS Code with encoded or obfuscated command strings, and file system monitoring alerts showing access to sensitive directories immediately after playbook execution. By mapping input sanitization failures to CWE-88 (Argument Injection), Casky's skills would flag the absence of proper input validation in extension command handling, alerting practitioners to review extension configurations and update to patched versions before adversaries leverage this attack vector.