CVE-2026-25931 in vscode-spell-checker
Summary
by MITRE • 02/10/2026
vscode-spell-checker is a basic spell checker that works well with code and documents. Prior to v4.5.4, DocumentSettings._determineIsTrusted treats the configuration value cSpell.trustedWorkspace as the authoritative trust flag. The value defaults to true (package.json) and is read from workspace configuration each time settings are fetched. The code coerces any truthy value to true and forwards it to ConfigLoader.setIsTrusted , which in turn allows JavaScript/TypeScript configuration files ( .cspell.config.js/.mjs/.ts , etc.) to be located and executed. Because no VS Code workspace-trust state is consulted, an untrusted workspace can keep the flag true and place a malicious .cspell.config.js ; opening the workspace causes the extension host to execute attacker-controlled Node.js code with the user’s privileges. This vulnerability is fixed in v4.5.4.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 02/10/2026
The vulnerability described in CVE-2026-25931 affects the vscode-spell-checker extension, a popular spell checking tool for visual studio code that operates effectively with both code and documentation. This issue stems from a critical flaw in how the extension handles workspace trust validation, specifically within the DocumentSettings._determineIsTrusted method. The vulnerability exists in versions prior to v4.5.4 where the extension incorrectly relies on a configuration value named cSpell.trustedWorkspace to determine trust status. This configuration parameter, which defaults to true in the package.json file, is read from workspace configuration each time settings are fetched without proper validation against actual workspace trust state.
The technical implementation of this vulnerability involves a dangerous coercion pattern where any truthy value is converted to true regardless of its original form, effectively bypassing proper trust validation mechanisms. When this coerced value is forwarded to ConfigLoader.setIsTrusted, it enables the extension to locate and execute JavaScript or TypeScript configuration files such as .cspell.config.js, .mjs, or .ts files. This execution occurs without verification of the actual VS Code workspace trust state, creating a significant security risk. The flaw allows an attacker to maintain a trusted workspace flag while placing malicious configuration files in an untrusted workspace, leading to arbitrary code execution with the user's privileges.
The operational impact of this vulnerability is severe as it enables remote code execution attacks through a simple workspace opening action. When a user opens a workspace that contains a malicious .cspell.config.js file, the extension host executes attacker-controlled Node.js code with full user privileges, potentially allowing for complete system compromise. This attack vector is particularly dangerous because it leverages the legitimate functionality of the spell checker extension to deliver malicious payloads, making detection more difficult. The vulnerability essentially transforms a benign development tool into an attack surface for privilege escalation and code execution.
Security mitigation for this vulnerability requires immediate updating to version 4.5.4 or later, which properly implements workspace trust validation. Organizations should also implement additional controls such as monitoring for unauthorized configuration file modifications in development environments and ensuring proper workspace trust management. The fix addresses the core issue by consulting actual VS Code workspace trust state rather than relying on potentially manipulated configuration values. This vulnerability aligns with CWE-284 Access Control Issues and represents a classic case of insufficient trust verification in software components, potentially mapping to ATT&CK technique T1059 Command and Scripting Interpreter for executing malicious code through legitimate extension mechanisms.