PT-2026-7180 · Microsoft · Vscode-Spell-Checker
Naxus-Audit
·
Published
2026-02-09
·
Updated
2026-03-31
·
CVE-2026-25931
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
vscode-spell-checker versions prior to 4.5.4
Description
The vscode-spell-checker extension is susceptible to a workspace-trust bypass that can lead to code execution. The
DocumentSettings. determineIsTrusted function incorrectly relies on the cSpell.trustedWorkspace configuration value as the sole indicator of trust. This value defaults to true and is read from the workspace configuration. Consequently, an untrusted workspace can place a malicious .cspell.config.js file, and opening the workspace will cause the extension host to execute attacker-controlled Node.js code with the user’s privileges. The ConfigLoader.setIsTrusted function is involved in this process, allowing the execution of JavaScript/TypeScript configuration files.Recommendations
Versions prior to 4.5.4 should be updated to version 4.5.4 or later.
Exploit
Fix
Incorrect Default Permissions
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Vscode-Spell-Checker