A command injection vulnerability in the VS Code Ansible Lightspeed extension allows arbitrary command execution with the privileges of the local user.

This is an OS command injection flaw (CWE-78) occurring in the handling of extension configuration settings. Attackers can inject shell commands via specific extension parameters, which may execute automatically during initialization or when running playbooks.

The vulnerability carries a CVSS 3.1 score of 7.8, representing a high-severity risk. Successful exploitation allows an attacker to execute arbitrary commands with the privileges of the user running Visual Studio Code. This can lead to local system compromise, data theft, or the execution of malicious automation routines within the development environment.

Immediate Action: Immediately uninstall or disable the Visual Studio Code Ansible Lightspeed extension. Exercise extreme caution by avoiding the opening of untrusted workspaces or executing playbooks from unverified sources.

Proactive Monitoring: Review workstation logs for unexpected shell executions or child processes spawned by the Visual Studio Code application.

Compensating Controls: Audit and sanitize configuration values for ansible.executionEnvironment.containerOptions and ansible.executionEnvironment.volumeMounts if the extension must be utilized in a restricted capacity.

Public Exploit Available: No (no confirmed public exploit available in current data).

Users should prioritize the removal or disabling of the vulnerable extension until a verified fix is provided by the vendor. Maintain strict operational security regarding the source of all Ansible playbooks and workspace configurations to prevent potential injection attempts.