Client-Side Vulnerability in Angular Language Service Extension for VS Code

CVE-2026-49241

What is CVE-2026-49241?

The Angular Language Service Extension for Visual Studio Code (VS Code) allows for rich editing features when developing Angular templates. Prior to version 21.2.4, the extension poses a risk by accessing custom TypeScript SDK paths directly from workspace configurations without confirming the Workspace Trust state or obtaining user consent. This occurs in the client-side extension, which sends these settings as command-line arguments to a backend Node.js language server. If a malicious actor places a harmful script within a custom directory specified in the settings, the extension can silently execute this script when a user opens the project in VS Code, making it a seamless target for exploitation. This critical issue was addressed in the update to version 21.2.4.

References