Angular Language Service Flaws Enable Remote Code Execution

A high-severity vulnerability was disclosed in the VS Code Angular Language Service extension (Angular.ng-template) that allows attackers to execute arbitrary code on developer machines, requiring only that a malicious project folder be opened.

Published under GHSA-ccq4-xmxr-8hcq by maintainer alan-agius4, the flaws affect all extension versions before 21.2.4 and carry a CVSS v4.0 score indicating high impact across confidentiality, integrity, and availability.

The disclosure arrives at a particularly critical moment: just days earlier, a compromised Nx Console VS Code extension, active for only 11–18 minutes, breached approximately 3,800 internal GitHub repositories and exfiltrated credentials from GitHub, npm, AWS, Kubernetes, and HashiCorp Vault.

Angular Language Service Flaws

The Angular Language Service advisory underscores a widening attack surface targeting developers directly through their IDE tooling.

The advisory details distinct execution chains, each capable of achieving full host compromise independently.

JSDoc Hover Markdown Command Injection (CWE-94, CWE-79): The extension’s client-side code (client/src/client.ts) configures VS Code’s Markdown tooltip renderer with the isTrusted: true flag, enabling active content.

The Angular Language Server, however, fails to sanitize or escape brackets and raw links in JSDoc strings before forwarding hover content through server/src/handlers/hover.ts and server/src/text_render.ts.

An attacker can embed a malicious command: URI inside a JSDoc comment in a TypeScript or JavaScript file or within a third-party npm package dependency, Atscott said.

When a developer hovers over the annotated symbol and clicks the rendered tooltip link, VS Code executes the injected command on the host machine.

Unsanitized tsdk Workspace Configuration / Insecure Dynamic Library Load (CWE-427, CWE-494): The extension reads typescript.tsdk and js/ts.tsdk.path workspace settings directly from the repository-level .vscode/settings.json files without verifying VS Code’s Workspace Trust model or requesting developer consent.

This path is passed as a --tsdk argument to the background Node.js language server, which dynamically loads tsserverlibrary.js from the attacker-controlled directory via Node’s native require(), Alan-Agius4 said.

Placing a malicious tsserverlibrary.js alongside a crafted .vscode/settings.json in a repository is sufficient zero user interaction is required. The extension loads and executes the script silently at workspace initialization.

Both attack vectors circumvent the core guarantees of VS Code’s Workspace Trust feature, a critical IDE boundary specifically designed to protect developers from malicious repositories.

The tsdk pathway is particularly stealthy: it executes entirely in the background on folder open, meaning routine operations like git clone, code reviews, or dependency audits become direct shell-level exploits, the Angular Team said.

Security researchers have increasingly flagged IDE extensions as a high-value supply chain attack vector, with critical vulnerabilities also recently identified in popular extensions, including Live Server (72M+ installs), Code Runner (37M+ installs), and Markdown Preview Enhanced.

The vulnerability carries the vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N, reflecting network-accessible delivery, low attack complexity, and no required privileges.

Four CWE weaknesses are mapped: CWE-79 (Cross-Site Scripting), CWE-94 (Code Injection), CWE-427 (Uncontrolled Search Path Element), and CWE-494 (Download of Code Without Integrity Check). No CVE identifier has been assigned at this time.

Mitigation

Developers using the Angular Language Service extension must immediately update to version 21.2.4, which applies fixes across pull requests #68857, #68858, #68859, and #68886 in the Angular repository.

Beyond patching, security professionals recommend turning off VS Code extension auto-updates and reviewing changes before upgrading, pinning extension versions in devcontainer.json files to prevent silent supply-chain-style compromises.

Organizations should audit all IDE extensions across engineering endpoints, removing anything not pinned to a verified version, and treat any developer workstation running a vulnerable version as potentially compromised, rotating all accessible secrets and credentials accordingly.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.