Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2026-25931: VS Code Spell Checker runs code in untrusted workspace
CVE-2026-25931 · published 8 months ago
Summary
The VS Code Spell Checker extension could run a malicious JavaScript configuration file when a folder is opened, even if that folder is marked as untrusted. This lets an attacker execute code on the user’s computer with their own privileges. Upgrade to version 4.5.4 or later to stop the problem.
Original advisory text
vscode-spell-checker has a workspace-trust bypass Code Execution
vscode-spell-checker is a basic spell checker that works well with code and documents. Prior to v4.5.4, DocumentSettings._determineIsTrusted treats the configuration value cSpell.trustedWorkspace as the authoritative trust flag. The value defaults to true (package.json) and is read from workspace configuration each time settings are fetched. The code coerces any truthy value to true and forwards it to ConfigLoader.setIsTrusted , which in turn allows JavaScript/TypeScript configuration files ( .cspell.config.js/.mjs/.ts , etc.) to be located and executed. Because no VS Code workspace-trust state is consulted, an untrusted workspace can keep the flag true and place a malicious .cspell.config.js ; opening the workspace causes the extension host to execute attacker-controlled Node.js code with the user’s privileges. This vulnerability is fixed in v4.5.4.
References
- https://drive.google.com/file/d/1mT4SOkkHSHU6NFfKwekysydAd3FUAC6K/view?usp=shari... URL
- https://github.com/streetsidesoftware/vscode-spell-checker/releases/tag/code-spe... URL
- https://github.com/streetsidesoftware/vscode-spell-checker/security/advisories/G... Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25931... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-25931 Vendor Advisory
- https://github.com/streetsidesoftware/vscode-spell-checker/commit/f39af9a3a6f2a9... Patch
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-276Incorrect Default Permissions
CWE-807Reliance on Untrusted Inputs in a Security Decision
CWE-829Inclusion of Functionality from Untrusted Control Sphere
Timeline
Published9 Feb 2026
Updated26 Oct 2026
First seen6 Mar 2026
Track software like this
Free during beta