Executive brief
The Angular Language Service extension for Visual Studio Code, which provides code editing features for Angular developers, contains a critical security flaw. An attacker can create a malicious project folder that, when opened by a developer, automatically executes hidden code on the developer's computer. This bypasses standard security warnings and could lead to a full system compromise, data theft, or the installation of malware just by viewing a repository.
Technical details
The Angular Language Service VS Code extension (Angular.ng-template) fails to verify VS Code Workspace Trust before reading custom TypeScript SDK paths (typescript.tsdk and js/ts.tsdk.path) from .vscode/settings.json. These paths are passed as a command-line argument (--tsdk) to a background Node.js language server process. During initialization, the server uses require() to dynamically import tsserverlibrary.js from the attacker-controlled path. An attacker can exploit this by committing a malicious script and a crafted settings file to a repository. When a user opens the folder, the extension automatically executes the malicious code with the privileges of the VS Code process. This is fixed in version 21.2.4 by ignoring workspace-level SDK paths in untrusted workspaces and requiring user consent in trusted ones.
Affected products
- Angular Angular Language Service VS Code Extension (Angular.ng-template) < 21.2.4
Timeline
- 2026-05-21: other: Initial fix PR submitted
- 2026-05-22: patched: Fixes merged into main branch
- 2026-05-23: advisory: GitHub Security Advisory published
- 2026-06-22: disclosed: CVE published to NVD