Vitorfhc

**Name of the Vulnerable Software and Affected Versions** Angular Language Service VS Code Extension versions prior to 21.2.4 **Description** The client-side extension reads custom TypeScript SDK paths from workspace configurations in `.vscode/settings.json` without verifying the VS Code Workspace Trust state or obtaining user consent. Specifically, it processes the `typescript.tsdk` and `js/ts.tsdk.path` variables and passes the resulting path as a `--tsdk` command-line argument to the background Node.js language server process. During initialization, the server dynamically imports the `tsserverlibrary.js` module relative to this path using the Node.js `require()` function. A remote attacker can exploit this by committing a repository containing a malicious `tsserverlibrary.js` script and a crafted `.vscode/settings.json` file. When a developer opens the repository, the extension automatically loads and executes the malicious script in the background. **Recommendations** Update to version 21.2.4.