CVE-2026-25931: vscode-spell-checker RCE Vulnerability

CVE-2026-25931 Overview

CVE-2026-25931 is a local code execution vulnerability in the vscode-spell-checker extension for Visual Studio Code. The vulnerability exists in how the extension handles workspace trust settings, allowing attackers to execute arbitrary Node.js code with the user's privileges when a victim opens a malicious workspace.

The extension's DocumentSettings._determineIsTrusted function treats the configuration value cSpell.trustedWorkspace as the authoritative trust flag. This value defaults to true in package.json and is read from workspace configuration each time settings are fetched. The code coerces any truthy value to true and forwards it to ConfigLoader.setIsTrusted, which allows JavaScript/TypeScript configuration files (.cspell.config.js, .mjs, .ts, etc.) to be located and executed.

Critical Impact
Opening an untrusted workspace containing a malicious .cspell.config.js file can result in arbitrary code execution with the current user's privileges, potentially leading to full system compromise.

Affected Products

vscode-spell-checker versions prior to v4.5.4
Visual Studio Code environments with the affected extension installed
Any system where users open untrusted workspaces with the vulnerable extension

Discovery Timeline

2026-02-09 - CVE CVE-2026-25931 published to NVD
2026-02-10 - Last updated in NVD database

Technical Details for CVE-2026-25931

Vulnerability Analysis

This vulnerability stems from a fundamental flaw in how vscode-spell-checker implements workspace trust. The extension fails to consult VS Code's native workspace-trust state, instead relying solely on its own cSpell.trustedWorkspace configuration value. Since this value defaults to true and can be controlled via workspace-level settings, an attacker can craft a malicious workspace that maintains the trusted state regardless of VS Code's actual trust assessment.

When the extension loads configuration, it searches for and executes JavaScript/TypeScript configuration files such as .cspell.config.js. Because the extension bypasses VS Code's trust mechanisms, these configuration files are executed in the extension host process with full access to Node.js APIs and the user's system privileges.

Root Cause

The root cause is an Insecure Default Configuration (CWE-276). The extension defaults cSpell.trustedWorkspace to true and fails to integrate with VS Code's workspace trust API. This means any workspace can be treated as trusted, allowing potentially malicious configuration files to execute. The _determineIsTrusted function accepts the workspace-controlled configuration value without verification against the VS Code trust framework.

Attack Vector

The attack requires local access and user interaction. An attacker creates a malicious repository or workspace containing:

A workspace settings file that maintains or sets cSpell.trustedWorkspace to a truthy value
A malicious .cspell.config.js file containing arbitrary Node.js code

When a victim clones and opens this workspace in VS Code with the vulnerable extension installed, the malicious configuration file executes automatically as part of the extension's initialization, granting the attacker code execution with the victim's privileges.

typescript

      * check all documents.
      * @returns void
      */
-    notifyConfigChange: () => void;
+    notifyConfigChange: (isWorkspaceTrusted: boolean | undefined) => void;
     /**
      * Register a configuration file to be loaded.
      * This is how to add a configuration file to the spell checker. It is mainly used to add language dictionaries.

Source: GitHub Commit Update

The security fix modifies the notifyConfigChange function signature to explicitly pass workspace trust status, ensuring the extension respects VS Code's trust determination.

text

     private gitIgnore = new GitIgnore();
     private loader = getDefaultConfigLoader();
     private isTrusted: boolean | undefined;
+    #isWorkspaceTrusted: boolean | undefined;
     private pIsTrusted: Promise<boolean> | undefined;
     private emitterOnDidUpdateConfiguration = createEmitter<ExtSettings>();
     #rootHref: string | undefined;

Source: GitHub Commit Update

The patch introduces a new private field #isWorkspaceTrusted to track the actual workspace trust state from VS Code, preventing the extension from relying solely on its own configuration value.

Detection Methods for CVE-2026-25931

Indicators of Compromise

Presence of suspicious .cspell.config.js, .cspell.config.mjs, or .cspell.config.ts files in workspace directories
Unexpected Node.js process spawning from VS Code extension host processes
Workspace settings files containing cSpell.trustedWorkspace set to true in untrusted repositories
Anomalous network connections or file system activity originating from VS Code processes

Detection Strategies

Monitor for the creation or modification of .cspell.config.* files in workspace directories
Audit VS Code extension versions to identify instances of vscode-spell-checker below v4.5.4
Implement file integrity monitoring for configuration files in development environments
Review workspace settings for suspicious trust-related configurations before opening unfamiliar repositories

Monitoring Recommendations

Enable VS Code's workspace trust feature and configure it to prompt for all untrusted workspaces
Deploy endpoint detection and response (EDR) solutions to monitor for suspicious code execution from VS Code processes
Implement logging and alerting for unexpected child processes spawned by VS Code
Consider application whitelisting to restrict executable code within development environments

How to Mitigate CVE-2026-25931

Immediate Actions Required

Update vscode-spell-checker to version v4.5.4 or later immediately
Enable VS Code's workspace trust feature via security.workspace.trust.enabled setting
Review recently opened workspaces for suspicious .cspell.config.* files
Audit development environments for potentially compromised systems if untrusted repositories were opened

Patch Information

The vulnerability is fixed in vscode-spell-checker version v4.5.4. The patch ensures the extension properly consults VS Code's workspace trust state before loading and executing JavaScript/TypeScript configuration files. The fix adds proper workspace trust tracking via the #isWorkspaceTrusted field and modifies the configuration change notification to include trust status.

Workarounds

Disable the vscode-spell-checker extension until it can be updated to the patched version
Enable VS Code's restricted mode for all untrusted workspaces to prevent extension code execution
Manually inspect workspaces for .cspell.config.js, .cspell.config.mjs, or .cspell.config.ts files before opening
Configure cSpell.trustedWorkspace to false in user-level settings (note: this may reduce functionality)

bash

# Check current extension version
code --list-extensions --show-versions | grep streetsidesoftware.code-spell-checker

# Update extension to patched version
code --install-extension streetsidesoftware.code-spell-checker@4.5.4

# Enable workspace trust in VS Code settings
# Add to settings.json:
# "security.workspace.trust.enabled": true