CVE-2026-50178: Angular Language Service VS Code Extension Remote Code Execution via Malicious JSDoc

Technical summary

The Angular Language Service VS Code extension uses the isTrusted: true configuration in the tooltip Markdown renderer, which instructs VS Code to parse and execute active elements including command: URIs. The server-side hover handler (server/src/handlers/hover.ts) and text rendering module (server/src/text_render.ts) fail to escape or sanitize brackets, raw links, and control characters extracted from JSDoc comments before forwarding them to the client. An attacker crafts malicious JSDoc annotations in a TypeScript or JavaScript file—either directly in the target project or via a compromised npm dependency—and embeds a Markdown command link. When a developer hovers to view the tooltip and interacts with it, VS Code executes the embedded command sequence. This is a client-side code execution vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation and CWE-94: Improper Control of Generation of Code) with a network-reachable attack surface if the malicious code is in a public dependency.

Business impact

Developer productivity is disrupted by the need to verify tooltip safety before interaction. More critically, any developer who clicks a malicious tooltip can have arbitrary commands executed on their workstation, potentially leading to credential theft, lateral movement to internal systems, supply chain compromise if the developer has push access to repositories, theft of source code or secrets stored locally, or installation of persistence mechanisms. For organizations with strict separation between development and production networks, a compromised developer machine can become an initial foothold. Teams relying on third-party npm packages face an elevated risk if a package is malicious or if a legitimate package is later compromised.

Affected systems

The Angular Language Service VS Code extension is affected in all versions prior to 21.2.4. Any developer using the extension to develop or review Angular projects is at risk, regardless of their operating system. The vulnerability is triggered when the developer's project (or a direct npm dependency) contains a malicious JSDoc comment and the developer hovers over the associated symbol in the editor.

Exploitability

Exploitability is high because the attack requires only user interaction (a hover and click on a tooltip), not special privileges or configuration. The CVSS vector reflects this: AV:N (network-reachable, e.g., via npm), AC:L (low complexity), PR:N (no privileges required), UI:R (requires user interaction), and high impact on confidentiality, integrity, and availability. The barrier to entry is low for an attacker with control over a project file or a popular npm package. Developers are accustomed to trusting tooltips and may not scrutinize them closely.

Remediation

Update the Angular Language Service VS Code extension to version 21.2.4 or later immediately. This version includes proper escaping and sanitization of JSDoc content before rendering. Additionally, audit your npm dependencies for suspicious or recently-added comments in package code. If your organization publishes packages to npm, review recent package versions for unexpected JSDoc additions that could indicate account compromise or malicious contribution.

Patch guidance

Users should update the Angular Language Service extension through the VS Code Extensions marketplace or via the command line using the VS Code CLI. The patch is available in version 21.2.4 and all subsequent releases. Verify the extension version in VS Code by navigating to Extensions, searching for Angular Language Service, and confirming the installed version is 21.2.4 or higher. There are no breaking changes or deprecations associated with this patch; upgrade immediately.

Detection guidance

Monitor for extension version drift in your organization by querying VS Code extension metadata from developer machines via MDM/EDR tools if available. Within projects, search for suspicious JSDoc comments containing Markdown command syntax (e.g., `[text](command:...)`) especially in recently added files or in vendored dependencies. Code review practices should flag unusual JSDoc additions in dependencies. IDEs and static analysis tools can be configured to warn on active Markdown command elements in documentation.

Why prioritize this

This vulnerability scores 8.8 (HIGH) and should be addressed urgently because it directly threatens the integrity of developer workstations and the supply chain. Any organization with developers using the Angular Language Service extension should prioritize patching within 24–48 hours. The low complexity and requirement only for user interaction make it a practical risk. While not currently in CISA's Known Exploited Vulnerabilities (KEV) catalog, the attack surface is broad (any npm package) and the impact is severe (arbitrary code execution).

Risk score, explained

The CVSS 3.1 score of 8.8 reflects: (1) Network-reachable attack vector via npm packages or shared projects; (2) Low attack complexity—no special conditions are needed; (3) No privileges required; (4) User interaction required (hover and click); (5) High confidentiality impact (sensitive data on developer machine can be exfiltrated); (6) High integrity impact (commands can alter code, deploy malicious changes); (7) High availability impact (workstation can be locked or damaged). The score is not critical (9.0–10.0) only because user interaction is required, but the practical impact for target developers is catastrophic.

Frequently asked questions