Critical Angular Language Service Extension Flaws Allow RCE

Key Takeaways

• High-severity vulnerabilities in the Angular Language Service extension for Visual Studio Code expose developers to remote code execution (RCE).
• The flaws exploit insecure input handling and configuration loading, bypassing VS Code’s Workspace Trust model.
• Attackers can achieve RCE through malicious JSDoc comments requiring minimal interaction or by placing malicious TypeScript SDK files for automatic execution upon project opening.
• All versions before 21.2.4 are affected; an urgent upgrade to version 21.2.4 or later is required.

Developers using the Angular Language Service extension for Visual Studio Code are at significant risk of remote code execution (RCE) attacks due to a series of critical vulnerabilities. These flaws, stemming from inadequate handling of user-controlled input and insecure configuration loading, create multiple pathways for attackers to compromise development systems.

Security researchers have demonstrated that malicious actors can leverage common development workflows, such as opening a project or reviewing code, to execute arbitrary commands on a developer’s machine, effectively bypassing established security measures.

Exploitation Pathways

One primary attack vector involves command injection via JSDoc hover functionality. The Angular Language Service extension’s Markdown rendering engine is configured with "isTrusted: true", a setting that permits the execution of embedded command URIs within rendered content. Crucially, the Angular language server fails to properly sanitize JSDoc comments before they are passed to this renderer.

This oversight allows an attacker to craft a malicious JSDoc comment containing a command link within a TypeScript or JavaScript file. When a developer hovers over the compromised symbol and subsequently clicks the embedded link, the command is executed directly on their host system.

A second, equally critical vulnerability centers on the insecure handling of the TypeScript SDK (tsdk) configuration. The extension reads tsdk-related settings directly from the workspace’s .vscode/settings.json file without validating workspace trust or seeking explicit user consent. This configured path is then passed to the background language server, which dynamically loads the tsserverlibrary.js file using Node.js require().

An attacker can exploit this by placing a malicious tsserverlibrary.js file within a project directory and referencing it via the workspace configuration. When a developer opens the compromised project, the extension silently executes the malicious code during initialization, requiring no user interaction whatsoever.

Bypassing Workspace Trust

These vulnerabilities are particularly concerning as they effectively circumvent VS Code’s Workspace Trust model, a security feature designed to prevent the execution of untrusted code. The tsdk-based attack is especially potent, as it triggers automatically upon project opening. The JSDoc-based attack, while requiring minimal user interaction, remains highly practical for real-world exploitation scenarios.

Successful exploitation can lead to complete system compromise, including unauthorized command execution, data theft, and the establishment of persistent access. For instance, a developer cloning a seemingly legitimate repository could unknowingly trigger the exploit simply by opening the project in VS Code, granting the attacker immediate control via a malicious configuration file.

The issues, detailed under GitHub advisory GHSA-ccq4-xmxr-8hcq, impact all versions of the Angular Language Service extension prior to 21.2.4. A patched release, version 21.2.4, has been made available to address these flaws.

Classified as high severity under CVSS v4, these vulnerabilities exhibit low attack complexity and require no special privileges for exploitation. They are associated with multiple weaknesses, including cross-site scripting, code injection, uncontrolled search path elements, and the execution of unverified code.

What You Should Do

• Upgrade Immediately: All developers are strongly advised to upgrade their Angular Language Service extension to version 21.2.4 or later without delay.
• Exercise Caution with Repositories: Avoid opening untrusted or unfamiliar repositories directly in VS Code. Always vet the source and contents of third-party projects.
• Review Configuration Files: Carefully inspect workspace configuration files (e.g., .vscode/settings.json) for suspicious entries, especially those related to TypeScript SDK paths.
• Implement Secure Development Practices: Maintain vigilance and adhere to secure development practices when integrating and working with third-party code.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.