CVE-2026-50178

Name of the Vulnerable Software and Affected Versions Angular Language Service VS Code Extension versions prior to 21.2.4

Description The client-side extension configures the tooltip Markdown renderer with the isTrusted: true option, causing VS Code to trust all rendered content and enable active elements like command URIs. The background Angular Language Server process fails to escape or sanitize brackets, raw links, and control characters from JSDoc strings before forwarding hover Markdown content. An attacker can exploit this by creating a TypeScript or JavaScript file, or a third-party npm package, containing a malicious JSDoc tooltip with an embedded active command link. If a developer hovers over the symbol and clicks the link, the IDE executes the command sequence on the host machine.

Recommendations Update to version 21.2.4.