Loading story…
A high-severity vulnerability in the Angular Language Service extension for Visual Studio Code, tracked as CVE-2026-50178, allows remote code execution when malicious JSDoc content is rendered inside hover tooltips. The flaw stems from the extension treating tooltip Markdown as trusted while the Angular Language Server forwards insufficiently sanitized JSDoc-derived content, including brackets, raw links, and control characters. An attacker can embed a crafted command: URI in a project file or a third-party npm dependency so that, when a developer hovers over the affected symbol and clicks the link, VS Code executes commands on the developer’s host machine.
The issue affects Angular.ng-template versions prior to 21.2.4 and can bypass normal Restricted Mode and Workspace Trust protections in VS Code. GitHub’s advisory says the bug was discovered and reported by CodeMender from Google DeepMind, and the published CVSS 4.0 base score is 8.7. Users are advised to upgrade the extension to version 21.2.4 or later to remediate the vulnerability.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
A CVE entry for the Angular Language Service extension flaw was published as CVE-2026-50178 with a CVSS 4.0 base score of 8.7, rated High. The entry describes the same command-injection path via trusted Markdown hover rendering and notes the issue is fixed in version 21.2.4.
The advisory states the issue affects Angular.ng-template versions before 21.2.4 and advises users to upgrade to version 21.2.4 or later. This identifies version 21.2.4 as the fix for the vulnerability.
Angular published a security advisory for a remote code execution flaw in the VS Code Angular Language Service extension caused by unsanitized JSDoc hover content being rendered as trusted Markdown. The advisory states that a crafted command URI in project files or third-party npm dependencies could execute code if a developer clicked the link in a hover tooltip.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Angular disclosed a high-severity arbitrary code execution flaw in the VS Code Angular Language Service extension (`Angular.ng-template`) that allowed a malicious repository to run code on a developer’s machine when the folder was opened in VS Code. The issue, tracked as **`CVE-2026-49241`**, affected versions prior to **`21.2.4`** and stemmed from the extension reading a workspace-configured `typescript.tsdk` path from `.vscode/settings.json` without honoring VS Code Workspace Trust or requiring user approval. That path was then passed to the background Node.js language server, which loaded `tsserverlibrary.js` from an attacker-controlled location, creating a zero-click path to host compromise and effectively bypassing VS Code Restricted Mode. Angular fixed the vulnerability in version **`21.2.4`** through two hardening changes: blocking workspace-level TypeScript SDK loading in untrusted workspaces and requiring explicit confirmation before loading a workspace-level SDK in trusted ones, with approval stored locally in secure workspace state. A second change disables the language server and related command registration until workspace trust is granted, preventing silent execution in restricted environments. The vulnerability was reported by **CodeMender from Google DeepMind** and is listed with a **CVSS 4.0 score of 8.7** as remotely exploitable.
Jun 29, 2026
A high-severity vulnerability, tracked as CVE-2025-66412, has been discovered in the Angular framework, allowing stored cross-site scripting (XSS) attacks through SVG animation, SVG URL, and MathML attributes. The flaw exists in the Angular Template Compiler, where the internal security schema fails to properly classify certain URL-holding attributes as requiring strict URL security, enabling attackers to inject malicious scripts that bypass Angular's built-in sanitization. This vulnerability affects Angular versions prior to 21.0.2, 20.3.15, and 19.2.17, and has been addressed in these subsequent releases. Attackers exploiting this vulnerability can persistently inject malicious JavaScript into web applications built with vulnerable Angular versions, potentially compromising user data and session integrity. Organizations using Angular are strongly advised to update to the fixed versions to mitigate the risk of exploitation. The vulnerability is remotely exploitable and has been rated as high severity, with a CVSS 4.0 score of 8.5, underscoring the urgency for prompt remediation.
Jun 29, 2026
Researchers disclosed multiple high-severity vulnerabilities in widely used Visual Studio Code extensions, including **Live Server**, **Markdown Preview Enhanced**, **Code Runner**, and **Microsoft Live Preview**, exposing developers to local file theft, cross-site scripting, data exfiltration, and remote code execution. Three issues were assigned identifiers `CVE-2025-65715`, `CVE-2025-65716`, and `CVE-2025-65717`, with separate disclosures highlighting flaws in **Markdown Preview Enhanced** and **Live Server**. The most severe issue, `CVE-2025-65717` in **Live Server**, could allow a remote unauthenticated attacker to exfiltrate files from a developer workstation through localhost access if the victim opens a malicious website. Security guidance accompanying the disclosures urged organizations to update affected VS Code extensions to fixed versions, restrict installed extensions to those that are necessary, and prefer trusted publishers to reduce developer workstation exposure.
Jul 24, 2026