Angular.js: The Angular Language Service VS Code Extension provides a rich editing experience for Angular templates. (CVE-2026-49241)

The Angular Language Service VS Code Extension (before 21.2.4) reads the custom TypeScript SDK paths (typescript.tsdk and js/ts.tsdk.path) directly from the workspace's .vscode/settings.json without verifying the VS Code Workspace Trust state or obtaining user consent. It then passes the parsed path as a command-line argument to the background Node.js language server, which dynamically imports the tsserverlibrary.js module relative to the specified custom directory. An attacker can exploit this by committing a malicious tsserverlibrary.js script and a crafted settings.json pointing to it. When a developer opens the repository in VS Code, the extension loads and executes the malicious script silently. This issue is resolved in version 21.2.4.

Successful exploitation allows an attacker to execute arbitrary code silently in the background when a developer opens a malicious repository in VS Code, potentially compromising the developer's environment with high confidentiality, integrity, and availability impact.

Upgrade the Angular Language Service VS Code Extension to version 21.2.4 or later, where this vulnerability is fixed. Until then, avoid opening untrusted repositories that contain custom TypeScript SDK paths in .vscode/settings.json. There is no indication that the vendor provides other mitigations or temporary fixes.