CVE-2026-50178: Angular Language Service XSS Vulnerability

CVE-2026-50178 Overview

CVE-2026-50178 affects the Angular Language Service VS Code Extension, which provides editing support for Angular templates. The client-side extension configures the tooltip Markdown renderer with isTrusted: true in client/src/client.ts. This setting tells VS Code to trust rendered content, enabling active elements such as command: URIs. The Angular Language Server fails to sanitize brackets, raw links, and control characters from JSDoc strings in server/src/handlers/hover.ts and server/src/text_render.ts. Attackers can embed malicious command: links in JSDoc comments that execute when developers hover over and click crafted symbols. The issue is fixed in version 21.2.4.

Critical Impact
Attackers can achieve arbitrary command execution on a developer's workstation through a malicious npm dependency or repository containing crafted JSDoc tooltips.

Affected Products

Angular Language Service VS Code Extension prior to 21.2.4
Angular Language Server component (server/src/handlers/hover.ts, server/src/text_render.ts)
Visual Studio Code installations using the vulnerable extension

Discovery Timeline

2026-06-22 - CVE-2026-50178 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2026-50178

Vulnerability Analysis

The vulnerability is a cross-site scripting class issue [CWE-79] adapted to the VS Code extension context. The Angular Language Service renders hover tooltips as Markdown to provide rich documentation for Angular symbols. The client configures the Markdown renderer with isTrusted: true, which authorizes VS Code to execute command: URI handlers embedded in the rendered output. Trusted Markdown was intended for content the extension itself generates, not arbitrary developer-supplied JSDoc strings. Because the server forwards JSDoc content without escaping square brackets, parentheses, or control characters, attacker-controlled documentation flows directly into the trusted renderer. Hovering over a symbol with a malicious JSDoc string produces a clickable link that invokes a VS Code command with attacker-supplied arguments when activated.

Root Cause

The root cause is missing output sanitization in the language server combined with an overly permissive trust setting in the client. The server-side hover handler treats JSDoc text as safe Markdown, while the client renders all received content under isTrusted: true. Neither side enforces a boundary between vendor-controlled UI chrome and developer-controlled documentation strings.

Attack Vector

An attacker publishes a malicious npm package or contributes a TypeScript or JavaScript file containing a crafted JSDoc comment. The JSDoc string embeds a Markdown link whose target is a command: URI invoking a VS Code command such as workspace shell execution. When a developer opens the project and hovers over the documented symbol, the tooltip renders the link. Clicking the link triggers command execution on the host with the developer's privileges. Exploitation requires user interaction but no authentication, and supply-chain delivery through npm makes mass targeting feasible.

No verified proof-of-concept code is published. See the GitHub Security Advisory for additional technical details.

Detection Methods for CVE-2026-50178

Indicators of Compromise

JSDoc comments in repository files or node_modules packages containing Markdown links with command: URI schemes
Unexpected child processes spawned by Code.exe, code, or VS Code helper processes shortly after a developer opens a project
Outbound network connections from developer workstations to attacker infrastructure following first-time interaction with a new dependency

Detection Strategies

Scan source repositories and node_modules directories for JSDoc strings containing the substring command: inside Markdown link syntax
Inventory installed VS Code extensions across developer fleets and flag Angular Language Service versions earlier than 21.2.4
Correlate VS Code parent process trees with shell, PowerShell, or scripting interpreter executions that lack a corresponding terminal session

Monitoring Recommendations

Enable endpoint telemetry capturing process creation events with full command lines for IDE processes
Monitor npm install events and new dependency additions, especially transitive packages flagged in supply-chain feeds
Alert on developer workstations executing reconnaissance commands such as whoami, ssh-add -L, or credential file reads sourced from IDE parents

How to Mitigate CVE-2026-50178

Immediate Actions Required

Upgrade the Angular Language Service VS Code Extension to version 21.2.4 or later through the VS Code Extensions marketplace
Audit installed npm dependencies for untrusted packages added recently and review their JSDoc content
Instruct developers to avoid hovering over symbols in untrusted repositories until the extension is patched

Patch Information

The vendor fixed the vulnerability in Angular Language Service VS Code Extension version 21.2.4. The fix sanitizes JSDoc content in server/src/handlers/hover.ts and server/src/text_render.ts before forwarding hover Markdown to the client. Refer to the GitHub Security Advisory GHSA-q94j-3wj3-4xcm for release details.

Workarounds

Disable or uninstall the Angular Language Service extension until the patched version is deployed
Open untrusted repositories in VS Code Restricted Mode, which suppresses extension features that rely on trusted Markdown rendering
Review and pin npm dependencies using lockfiles and integrity checks to reduce exposure to malicious package updates

bash

# Upgrade the Angular Language Service extension to the patched version
code --install-extension Angular.ng-template@21.2.4 --force

# Verify the installed version
code --list-extensions --show-versions | grep ng-template