Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
vscode-spell-checker is a basic spell checker that works well with code and documents. Prior to v4.5.4, DocumentSettings._determineIsTrusted treats the configuration value cSpell.trustedWorkspace as the authoritative trust flag. The value defaults to true (package.json) and is read from workspace configuration each time settings are fetched. The code coerces any truthy value to true and forwards it to ConfigLoader.setIsTrusted , which in turn allows JavaScript/TypeScript configuration files ( .cspell.config.js/.mjs/.ts , etc.) to be located and executed. Because no VS Code workspace-trust state is consulted, an untrusted workspace can keep the flag true and place a malicious .cspell.config.js ; opening the workspace causes the extension host to execute attacker-controlled Node.js code with the user’s privileges. This vulnerability is fixed in v4.5.4.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
CVE-2026-25931 vscode-spell-checker is a basic spell checker that works well with code and documents. Prior to v4.5.4, DocumentSettings._determineIsTrusted treats the configuration … https://www.cve.org/CVERecord?id=CVE-2026-25931
Post summary
The text highlights CVE-2026-25931 for vscode‑spell‑checker, noting the issue is fixed in version 4.5.4 and provides a link to the CVE record.
VS Code Spell Checker has a workspace-trust bypass (CVE-2026-25931) leading to code execution. Update to fixed version. #VSCode #Security #CVE https://www.pulsepatch.io/posts/cve-2026-25931-vscode-spell-checker-code-execution
Post summary
The post announces CVE-2026-25931, a workspace-trust bypass in VS Code Spell Checker that enables code execution, and advises users to update to the fixed version.