CVE-2026-49241

Name of the Vulnerable Software and Affected Versions Angular Language Service VS Code Extension versions prior to 21.2.4

Description The client-side extension reads custom TypeScript SDK paths from workspace configurations in .vscode/settings.json without verifying the VS Code Workspace Trust state or obtaining user consent. Specifically, it processes the typescript.tsdk and js/ts.tsdk.path variables and passes the resulting path as a --tsdk command-line argument to the background Node.js language server process. During initialization, the server dynamically imports the tsserverlibrary.js module relative to this path using the Node.js require() function. A remote attacker can exploit this by committing a repository containing a malicious tsserverlibrary.js script and a crafted .vscode/settings.json file. When a developer opens the repository, the extension automatically loads and executes the malicious script in the background.

Recommendations Update to version 21.2.4.