Description
A flaw was found in the Ansible Lightspeed extension for Visual Studio Code. This vulnerability allows an attacker with local access to the workstation, or malware running with the user-s privileges, to read the Google Gemini API key. The extension insecurely stores the API key in plain text within the user-s configuration file and writes it to output log files. This information disclosure can lead to the attacker obtaining the API credential and potentially consuming the user-s API quota.
CVSS 3.3EPSS 0.089%Risk 0.33
View source- Published
- 2026-07-22 12:17:59
- Affected versions
- unknown
- Type
- Critical software
- Last modified
- 2026-07-22 17:16:56
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N