CVE-2026-50178 Angular: Remote Code Execution via JSDoc Hover Command Injection in VS Code Angular Language Service Extension
Attackers can execute arbitrary commands on a developer's machine by crafting malicious JSDoc comments that trigger command links in the Angular Language Service extension.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-50178?
CVE-2026-50178 is a high-severity command injection vulnerability in Angular.ng-template, published on 22 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Angular Language Service VS Code Extension provides a rich editing experience for Angular templates. the client-side Angular Language Service VS Code extension configures the tooltip Markdown renderer with the isTrusted: true option (located in client/src/client.ts). This setting instructs VS Code to trust all rendered content it receives, which enables active elements such as command: URIs. However, the background Angular Language Server process fails to escape or sanitize brackets, raw links, and control characters from JSDoc strings before forwarding the hover Markdown content (located in server/src/handlers/hover.ts and server/src/text_render.ts). An attacker can leverage this behavior by crafting a project TypeScript or JavaScript file (or a third-party npm package dependency) containing a malicious JSDoc tooltip with an embedded active command link. When a developer hovers over the target symbol to render the tooltip and clicks the malicious link, the IDE executes the command sequence directly on the developer's host machine. Prior to 21.2.4, This vulnerability is fixed in 21.2.4.
Which versions are affected by CVE-2026-50178?
It affects 1 product.
Products include Angular Angular Language Service.
How do I fix CVE-2026-50178?
No fix has been published for CVE-2026-50178 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-50178 being exploited?
There is no known exploitation of CVE-2026-50178 in the wild and no public exploit code.
Other vulnerabilities in Angular.ng-template
Sources
Also known as GHSA-q94j-3wj3-4xcm, UBUNTU-CVE-2026-50178.