CyberRota Analysis
AI-GeneratedThe Visual Studio Code Ansible Lightspeed extension is vulnerable due to a command injection flaw that improperly handles specific configuration settings, allowing attackers to inject shell commands. This vulnerability can be exploited automatically or manually, leading to remote code execution with the privileges of the Visual Studio Code user, which may result in full system compromise. Organizations using this extension should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A flaw was found in the Visual Studio Code Ansible Lightspeed extension. This command injection vulnerability (CWE-78) arises from improper handling of the ansible.executionEnvironment.containerOptions and ansible.executionEnvironment.volumeMounts settings, allowing an attacker to inject shell separators. This can be triggered automatically during Language Server initialization or manually when executing a playbook. Successful exploitation leads to remote code execution (RCE) on the victim's machine with the privileges of the Visual Studio Code user, potentially resulting in a complete system compromise.