Three command injections in Ansible Lightspeed, plus MongoDB RBAC bypass

The Ansible Lightspeed extension doesn't validate the ansible.python.activationScript setting as a proper file path. An attacker who gets you to open a crafted project can inject arbitrary commands through that setting, giving them full control of your machine under VS Code's user privileges.

Affected estate

Developers and automation engineers using the Ansible Lightspeed extension in Visual Studio Code

How to check

Check the installed extension version in VS Code's Extensions panel. Also search your workspace .vscode/settings.json files for ansible.python.activationScript entries you didn't set yourself.

Included because

user interaction required (opening a project); RCE; command injection; CVSS 7.8

Action

Update the extension. Remove or correct any suspicious ansible.python.activationScript values in workspace settings.

Why it matters

A poisoned project file can execute arbitrary commands the moment you open or run it, with full user privileges.

A specially crafted playbook filename with shell metacharacters can trick the Ansible Lightspeed extension into running arbitrary code when you execute the playbook. The extension doesn't sanitize the filename before passing it to a shell. This can lead to data theft, file modification, or full system compromise.

Affected estate

Developers and automation engineers using the Ansible Lightspeed extension in Visual Studio Code

How to check

Check the installed extension version in VS Code's Extensions panel against the vendor advisory.

Included because

user interaction required (running a playbook); RCE via filename injection; CVSS 7.8

Action

Update the extension. Do not run playbooks from untrusted repositories until the fix is confirmed in place.

Why it matters

Running a playbook with a malicious filename gives the attacker code execution under your VS Code user account.

When compute mode is explicitly enabled on a standalone mongod instance, crafted BSON data in an aggregation pipeline can corrupt memory and crash the process or worse. This is a non-default configuration, so most MongoDB deployments aren't exposed. If you've turned on compute mode, though, this is a real concern at CVSS 8.1.

Affected estate

MongoDB operators running standalone mongod instances with compute mode explicitly enabled

How to check

Review your mongod startup flags or configuration file for compute mode enablement. Run db.adminCommand({getCmdLineOpts: 1}) to inspect active options.

Included because

non-default config required; memory corruption; CVSS 8.1; no exploit in the wild

Action

Upgrade MongoDB to the patched version. As a workaround, disable compute mode if it's not strictly needed.

Why it matters

Memory corruption from crafted BSON can crash your database process or potentially allow further exploitation.

A low-privilege authenticated user can bypass role-based access controls and read or write data they shouldn't have access to. The bug hits find, update, delete, and aggregate commands when apiStrict mode isn't enabled. If you rely on MongoDB's RBAC to enforce data boundaries between users or tenants, this one breaks that trust boundary.

Affected estate

MongoDB operators relying on role-based query-level access controls in non-apiStrict configurations

How to check

Check whether apiStrict is enabled in your connection options or mongod/mongos configuration. If it's not, and you use document-level RBAC, you're exposed.

Included because

authenticated but low-privilege; RBAC bypass for reads and writes; CVSS 8.1; common product

Action

Upgrade MongoDB to the patched version. If patching is delayed, enable apiStrict mode to block the vulnerable command paths.

Why it matters

Any authenticated user, even one with minimal privileges, can read and modify data outside their authorized scope, breaking your access control model.