Executive Summary

The vulnerability exists in the vscode-spell-checker extension prior to version 4.5.4. The extension's DocumentSettings._determineIsTrusted method treats the configuration value cSpell.trustedWorkspace as the authoritative trust flag, which defaults to true and is read from workspace configuration each time settings are fetched.

Because the code coerces any truthy value to true and forwards it to ConfigLoader.setIsTrusted without consulting the actual VS Code workspace-trust state, an untrusted workspace can keep this flag true and place a malicious .cspell.config.js file.

When the workspace is opened, the extension host executes this attacker-controlled Node.js code with the user's privileges, leading to potential code execution.

This vulnerability was fixed in version 4.5.4 of the extension.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

I don't know

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to execute arbitrary Node.js code on your machine with the same privileges as the user running the vscode-spell-checker extension.

An attacker can place a malicious .cspell.config.js file in an untrusted workspace, and when you open that workspace, the malicious code will run.

This can lead to full compromise of your user environment, including data theft, system manipulation, or further malware installation.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade vscode-spell-checker to version 4.5.4 or later, where the issue is fixed.

Avoid opening untrusted workspaces that might contain malicious .cspell.config.js files, as these can execute attacker-controlled Node.js code with your user privileges.

Useful 0 Not Useful 0