High-Severity RCE Vulnerabilities Found in Angular Language Service Extension

Multiple high-severity vulnerabilities have been identified in the Angular Language Service extension for Visual Studio Code, potentially allowing remote code execution (RCE) attacks. These vulnerabilities stem from insecure handling of user-controlled input and unsafe configuration loading, affecting all versions prior to 21.2.4. Attackers can exploit these flaws through malicious project files and dependencies. The vulnerabilities are tracked under GitHub advisory GHSA-ccq4-xmxr-8hcq. Developers using the extension are at risk, and a patch has been released to address these issues. Users are urged to update to the latest version to mitigate the risks associated with these vulnerabilities.

Key Points: • High-severity RCE vulnerabilities found in Angular Language Service extension. • Affected versions include all prior to 21.2.4; patch available in the latest release. • Exploitation can occur via malicious project files and unsafe configuration loading.