CVE-2026-25931 json
vscode-spell-checker has a workspace-trust bypass Code Execution
published 2026-02-09 8 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-6467
- cvss
- 7.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.1%
- EPSS 0.1% chance of exploitation in 30 days, percentile 4%
- public exploits
- 0
- none known
Summary
vscode-spell-checker is a basic spell checker that works well with code and documents. Prior to v4.5.4, DocumentSettings._determineIsTrusted treats the configuration value cSpell.trustedWorkspace as the authoritative trust flag. The value defaults to true (package.json) and is read from workspace configuration each time settings are fetched. The code coerces any truthy value to true and forwards it to ConfigLoader.setIsTrusted , which in turn allows JavaScript/TypeScript configuration files ( .cspell.config.js/.mjs/.ts , etc.) to be located and executed. Because no VS Code workspace-trust state is consulted, an untrusted workspace can keep the flag true and place a malicious .cspell.config.js ; opening the workspace causes the extension host to execute attacker-controlled Node.js code with the user’s privileges. This vulnerability is fixed in v4.5.4.
Patch / fix
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 8 mo ago
Exploit prediction
0.15% chance of exploitation in the next 30 days, higher than 4% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Affected products
- streetsidesoftware vscode-spell-checker
Classification
References
- github.com /streetsidesoftware/vscode-spell-checker/commit/f39af9a3a6f2a939a57171a24161ed735d41c575
- github.com /streetsidesoftware/vscode-spell-checker/security/advisories/GHSA-mggq-68mr-58vj
- drive.google.com /file/d/1mT4SOkkHSHU6NFfKwekysydAd3FUAC6K/view?usp=sharing
- github.com /streetsidesoftware/vscode-spell-checker/releases/tag/code-spell-checker-v4.5.4
Sources
- CVE List CVE-2026-25931
- NVD CVE-2026-25931
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.