Remote Code Execution via JSDoc Hover Command Injection in VS Code Angular Language Service Extension

The client-side Angular Language Service VS Code extension configures the tooltip Markdown renderer with the `isTrusted: true` option (located in `client/src/client.ts`). This setting instructs VS Code to trust all rendered content it receives, which enables active elements such as `command:` URIs. However, the background Angular Language Server process fails to escape or sanitize brackets, raw links, and control characters from JSDoc strings before forwarding the hover Markdown content (located in `server/src/handlers/hover.ts` and `server/src/text_render.ts`). An attacker can leverage this behavior by crafting a project TypeScript or JavaScript file (or a third-party npm package dependency) containing a malicious JSDoc tooltip with an embedded active command link. When a developer hovers over the target symbol to render the tooltip and clicks the malicious link, the IDE executes the command sequence directly on the developer's host machine. ### Impact Any developer using the VS Code Angular Language Service extension (`Angular.ng-template`) prior to version `21.2.4` who opens a project workspace containing files or dependencies with crafted JSDoc comments is vulnerable to arbitrary Remote Code Execution. Because this pathway can execute commands despite standard VS Code Restricted Mode limits, it bypasses the core guarantees of VS Code's Workspace Trust model. An interactive hover click can be chained to execute arbitrary shell commands, turning ordinary activities like code reviews, dependency updates, or code exploration into direct developer host compromises. ### Attack Preconditions To successfully exploit this vulnerability, the following environment parameters and user actions must take place: 1. **Extension Installed & Active:** The victim developer must have the VS Code Angular Language Service extension (`Angular.ng-template`, version prior to `21.2.4`) active in their workspace. 2. **Malicious JSDoc comment in Source:** The developer must open a code folder (or install a package dependency) that houses a TS/JS file with a JSDoc payload containing a formatted link and active `command:` URI parameters inside an inline template. 3. **User Interaction (Click):** The developer must hover over the target symbol to render the Markdown tooltip popup and click the active link inside the balloon bubble. ### Patches Upgrade the VS Code Angular Language Service extension (`Angular.ng-template`) to version `21.2.4` or later. ### References * **Harden JSDoc Markdown trust and document opening:** [PR #68858](https://github.com/angular/angular/pull/68858) * **Disable language server in untrusted workspaces:** [PR #68886](https://github.com/angular/angular/pull/68886) * **VS Code Extension Security Guidelines (Trusted Markdown):** [Virtual Documents Guide](https://code.visualstudio.com/api/extension-guides/virtual-documents#trusted-markdown) * **VS Code Workspace Trust Specifications:** [Workspace Trust Guide](https://code.visualstudio.com/docs/editor/workspace-trust) * **VS Code Extension Guidelines on Workspace Trust:** [Workspace Trust Extension API Guide](https://code.visualstudio.com/api/extension-guides/workspace-trust) ### Credits This vulnerability was discovered and reported by [CodeMender from Google DeepMind](https://deepmind.google/blog/introducing-codemender-an-ai-agent-for-code-security/).

Quoted source text, attributed separately from HOL analysis.