By weakness (CWE)

CWE-494: related vulnerabilities

CVEs classified under CWE-494. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

1 published vulnerability

• CVE-2026-49241HIGH 8.8

  The Angular Language Service VS Code Extension allows developers to write Angular code with advanced IDE features like autocomplete and error checking. A critical flaw in versions before 21.2.4 lets an attacker hide malicious code in a project repository that automatically executes when a developer opens that folder in VS Code. The attack works by placing a fake TypeScript library file in the repository and configuring VS Code settings to point to it—the extension loads and runs this fake library without asking permission or checking if the workspace is trusted. An attacker only needs to commit the malicious code to a repository (like on GitHub) and wait for developers to clone and open it.