Compliance Impact

The vulnerability allows arbitrary remote code execution by silently loading and executing malicious scripts from untrusted workspace configurations without user consent or verification. This can lead to unauthorized access, modification, or disruption of data and systems.

Such unauthorized code execution and potential data compromise can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require strict controls over data confidentiality, integrity, and availability.

Specifically, the vulnerability's ability to bypass security measures and execute malicious code could lead to breaches of personal or sensitive data, violating regulatory requirements for protecting such information.

Useful 0 Not Useful 0

Executive Summary

The vulnerability in the Angular Language Service VS Code Extension (prior to version 21.2.4) arises because the extension reads custom TypeScript SDK paths directly from workspace configuration files without verifying if the workspace is trusted or asking for user consent.

It then passes these paths as command-line arguments to a background Node.js language server, which dynamically loads and executes a module (tsserverlibrary.js) from the specified path.

An attacker can exploit this by committing a repository containing a malicious tsserverlibrary.js script and a crafted .vscode/settings.json file pointing to that script. When a developer opens the repository in VS Code, the extension silently loads and executes the malicious code without warning.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to execute arbitrary code on a developer's machine without their knowledge or consent simply by opening a malicious repository in VS Code.

Such arbitrary remote code execution can compromise the confidentiality, integrity, and availability of the developer's system and data.

It can lead to unauthorized access, data theft, system manipulation, or disruption of development workflows.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the Angular Language Service VS Code extension loading malicious scripts from workspace configurations without verifying workspace trust. Detection involves checking if your VS Code workspace contains suspicious or unexpected .vscode/settings.json files that specify custom TypeScript SDK paths (typescript.tsdk or js/ts.tsdk.path) pointing to unusual directories.

You can manually inspect the .vscode/settings.json file in your project folders for suspicious tsdk path entries.

Additionally, monitoring for unexpected Node.js processes spawned by the Angular Language Service extension or unusual file access to tsserverlibrary.js files in workspace directories may help detect exploitation attempts.

While no specific commands are provided in the resources, you can use commands like the following to check for suspicious settings files and tsserverlibrary.js files:

• Find all .vscode/settings.json files in your workspace: `find . -path '*/.vscode/settings.json'`
• Search for tsdk path entries in these settings files: `grep -H 'tsdk' **/.vscode/settings.json`
• Look for tsserverlibrary.js files in your workspace: `find . -name 'tsserverlibrary.js'`
• Monitor running Node.js processes related to Angular Language Service: `ps aux | grep node` and check command line arguments for --tsdk usage.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade the Angular Language Service VS Code extension to version 21.2.4 or later, where this vulnerability is fixed.

This update enforces workspace trust verification before loading custom TypeScript SDK paths and prevents the language server from launching in untrusted workspaces.

Additionally, avoid opening untrusted or suspicious repositories in VS Code without verifying their contents, especially those containing .vscode/settings.json files with custom tsdk paths.

If you must work with untrusted workspaces, ensure that VS Code's Workspace Trust feature is enabled and only grant trust explicitly after careful review.

Useful 0 Not Useful 0