CVE-2026-50178

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-50178
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-50178.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-50178
Aliases
  • GHSA-q94j-3wj3-4xcm
Downstream
Published
2026-06-22T15:20:39.800Z
Modified
2026-07-08T08:13:41.181596119Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Angular: Remote Code Execution via JSDoc Hover Command Injection in VS Code Angular Language Service Extension
Details

The Angular Language Service VS Code Extension provides a rich editing experience for Angular templates. the client-side Angular Language Service VS Code extension configures the tooltip Markdown renderer with the isTrusted: true option (located in client/src/client.ts). This setting instructs VS Code to trust all rendered content it receives, which enables active elements such as command: URIs. However, the background Angular Language Server process fails to escape or sanitize brackets, raw links, and control characters from JSDoc strings before forwarding the hover Markdown content (located in server/src/handlers/hover.ts and server/src/text_render.ts). An attacker can leverage this behavior by crafting a project TypeScript or JavaScript file (or a third-party npm package dependency) containing a malicious JSDoc tooltip with an embedded active command link. When a developer hovers over the target symbol to render the tooltip and clicks the malicious link, the IDE executes the command sequence directly on the developer's host machine. Prior to 21.2.4, This vulnerability is fixed in 21.2.4.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50178.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-79",
        "CWE-94"
    ]
}
References

Affected packages

Git / github.com/angular/angular

Affected ranges

Type
GIT
Repo
https://github.com/angular/angular
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
525e1605a6b3ca634a98fda080bd0b3d236f4513
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "21.2.4"
        }
    ]
}

Affected versions

10.*
10.0.0-next.0
10.0.0-next.1
10.0.0-next.2
10.0.0-next.3
10.0.0-next.4
10.0.0-next.5
10.0.0-next.6
10.0.0-next.7
10.0.0-next.8
10.0.0-next.9
10.0.0-rc.0
10.1.0-next.0
10.1.0-next.1
10.1.0-next.2
10.1.0-next.3
10.1.0-next.4
10.1.0-next.5
10.1.0-next.6
10.1.0-next.7
10.1.0-next.8
10.1.0-rc.0
11.*
11.0.0-next.0
11.0.0-next.1
11.0.0-next.2
11.0.0-next.3
11.0.0-next.4
11.0.0-next.5
11.0.0-next.6
11.1.0-next.0
11.1.0-next.1
11.1.0-next.2
11.1.0-next.3
11.1.0-next.4
12.*
12.0.0-next.0
12.0.0-next.1
12.0.0-next.2
12.0.0-next.3
12.0.0-next.4
12.0.0-next.5
12.0.0-next.6
12.0.0-next.7
12.0.0-next.8
12.1.0
12.1.0-next.2
12.1.0-next.3
12.1.0-next.4
12.1.0-next.5
12.1.0-next.6
12.2.0-next.0
12.2.0-next.1
12.2.0-next.2
12.2.0-next.3
13.*
13.0.0-next.0
13.0.0-next.1
13.0.0-next.10
13.0.0-next.11
13.0.0-next.12
13.0.0-next.13
13.0.0-next.14
13.0.0-next.2
13.0.0-next.3
13.0.0-next.4
13.0.0-next.5
13.0.0-next.6
13.0.0-next.7
13.0.0-next.8
13.0.0-next.9
13.1.0-next.0
13.1.0-next.1
13.1.0-next.2
13.1.0-next.3
13.2.0-next.0
13.2.0-next.1
13.2.0-next.2
14.*
14.0.0-next.0
14.0.0-next.1
14.0.0-next.10
14.0.0-next.11
14.0.0-next.12
14.0.0-next.13
14.0.0-next.14
14.0.0-next.15
14.0.0-next.2
14.0.0-next.3
14.0.0-next.4
14.0.0-next.5
14.0.0-next.6
14.0.0-next.7
14.0.0-next.8
14.0.0-next.9
14.1.0-next.0
14.1.0-next.1
14.1.0-next.2
14.1.0-next.3
14.1.0-next.4
14.2.0-next.0
14.2.0-next.1
15.*
15.0.0-next.0
15.0.0-next.1
15.0.0-next.2
15.0.0-next.3
15.0.0-next.4
15.0.0-next.5
15.1.0-next.0
15.1.0-next.1
15.1.0-next.2
15.1.0-next.3
15.2.0-next.0
15.2.0-next.1
15.2.0-next.2
15.2.0-next.3
15.2.0-next.4
16.*
16.0.0-next.0
16.0.0-next.1
16.0.0-next.2
16.0.0-next.3
16.0.0-next.4
16.0.0-next.5
16.0.0-next.6
16.1.0-next.0
16.1.0-next.1
16.1.0-next.2
16.1.0-next.3
16.2.0-next.0
16.2.0-next.1
16.2.0-next.2
16.2.0-next.3
16.2.0-next.4
17.*
17.0.0-next.0
17.0.0-next.1
17.0.0-next.2
17.0.0-next.3
17.0.0-next.4
17.0.0-next.5
17.0.0-next.6
17.0.0-next.7
17.1.0-next.0
17.1.0-next.1
17.1.0-next.2
17.1.0-next.3
17.1.0-next.4
17.1.0-next.5
17.2.0-next.0
17.2.0-next.1
17.3.0-next.0
17.3.0-next.1
18.*
18.0.0-next.0
18.0.0-next.1
18.0.0-next.2
18.0.0-next.3
18.0.0-next.4
18.0.0-next.5
18.1.0-next.0
18.1.0-next.1
18.1.0-next.2
18.1.0-next.3
18.1.0-next.4
18.2.0-next.0
18.2.0-next.1
18.2.0-next.2
18.2.0-next.3
18.2.0-next.4
19.*
19.0.0-next.0
19.0.0-next.1
19.0.0-next.10
19.0.0-next.2
19.0.0-next.3
19.0.0-next.4
19.0.0-next.5
19.0.0-next.6
19.0.0-next.7
19.0.0-next.8
19.0.0-next.9
19.1.0-next.0
19.1.0-next.1
19.1.0-next.2
19.1.0-next.3
19.1.0-next.4
19.2.0-next.0
19.2.0-next.1
19.2.0-next.2
19.2.0-next.3
2.*
2.0.0
2.0.0-alpha.13
2.0.0-alpha.14
2.0.0-alpha.15
2.0.0-alpha.17
2.0.0-alpha.18
2.0.0-alpha.19
2.0.0-alpha.20
2.0.0-alpha.21
2.0.0-alpha.22
2.0.0-alpha.23
2.0.0-alpha.24
2.0.0-alpha.25
2.0.0-alpha.26
2.0.0-alpha.27
2.0.0-alpha.28
2.0.0-alpha.29
2.0.0-alpha.30
2.0.0-alpha.31
2.0.0-alpha.32
2.0.0-alpha.33
2.0.0-alpha.34
2.0.0-alpha.35
2.0.0-alpha.40
2.0.0-alpha.41
2.0.0-alpha.42
2.0.0-alpha.44
2.0.0-alpha.47
2.0.0-alpha.48
2.0.0-alpha.49
2.0.0-alpha.50
2.0.0-alpha.51
2.0.0-alpha.52
2.0.0-alpha.53
2.0.0-alpha.54
2.0.0-alpha.55
2.0.0-beta.0
2.0.0-beta.11
2.0.0-beta.12
2.0.0-beta.13
2.0.0-beta.14
2.0.0-beta.16
2.0.0-beta.17
2.0.0-beta.6
2.0.0-beta.7
2.0.0-beta.8
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.0-rc.3
2.0.0-rc.4
2.0.0-rc.5
2.0.0-rc.6
2.0.0-rc.7
2.1.0
2.1.0-beta.0
2.1.0-rc.0
2.2.0
2.2.0-beta.0
2.2.0-beta.1
2.2.0-rc.0
2.3.0
2.3.0-beta.0
2.3.0-rc.0
2.4.0-marker
20.*
20.0.0-next.0
20.0.0-next.1
20.0.0-next.2
20.0.0-next.3
20.0.0-next.4
20.0.0-next.5
20.0.0-next.6
20.0.0-next.7
20.0.0-next.8
20.1.0-next.0
20.1.0-next.1
20.1.0-next.2
20.1.0-next.3
20.2.0-next.0
20.2.0-next.1
20.2.0-next.2
20.2.0-next.3
20.2.0-next.4
20.2.0-next.5
20.2.0-next.6
21.*
21.0.0-next.0
21.0.0-next.1
21.0.0-next.2
21.0.0-next.3
21.0.0-next.4
21.0.0-next.5
21.0.0-next.6
21.0.0-next.7
21.0.0-next.8
21.1.0-next.0
21.1.0-next.1
4.*
4.0.0
4.0.0-beta.0
4.0.0-beta.1
4.0.0-beta.2
4.0.0-beta.3
4.0.0-beta.5
4.0.0-beta.6
4.0.0-beta.7
4.0.0-beta.8
4.0.0-rc.1
4.0.0-rc.2
4.0.0-rc.3
4.0.0-rc.4
4.0.0-rc.5
4.0.0-rc.6
4.1.0
4.1.0-beta.0
4.1.0-beta.1
4.1.0-rc.0
4.2.0-beta.0
4.2.0-rc.0
4.2.0-rc.1
4.2.0-rc.2
4.2.1
4.3.0
4.3.0-beta.0
4.3.0-beta.1
4.3.0-rc.0
5.*
5.0.0-beta.0
5.0.0-beta.1
5.0.0-beta.2
5.0.0-beta.3
5.0.0-beta.4
5.0.0-beta.5
5.0.0-beta.6
5.0.0-beta.7
5.0.0-rc.0
5.0.0-rc.1
5.0.0-rc.2
5.0.0-rc.3
5.0.0-rc.4
5.1.0
5.1.0-beta.0
5.1.0-beta.1
5.1.0-beta.2
5.1.0-rc.0
5.1.0-rc.1
5.2.0
5.2.0-beta.0
5.2.0-beta.1
5.2.0-rc.0
6.*
6.0.0-beta.0
6.0.0-beta.1
6.0.0-beta.2
6.0.0-beta.3
6.0.0-beta.4
6.0.0-beta.6
6.0.0-beta.7
6.0.0-beta.8
6.0.0-rc.0
6.0.0-rc.1
6.0.0-rc.2
6.0.0-rc.3
6.0.0-rc.4
6.0.0-rc.5
6.1.0
6.1.0-beta.0
6.1.0-beta.1
6.1.0-beta.2
6.1.0-beta.3
6.1.0-rc.3
7.*
7.0.0-beta.0
7.0.0-beta.1
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-rc.0
7.0.0-rc.1
7.1.0
7.1.0-beta.0
7.1.0-beta.1
7.1.0-beta.2
7.1.0-rc.0
7.2.0
7.2.0-beta.1
7.2.0-beta.2
7.2.0-rc.0
8.*
8.0.0-beta.0
8.0.0-beta.1
8.0.0-beta.10
8.0.0-beta.11
8.0.0-beta.12
8.0.0-beta.13
8.0.0-beta.14
8.0.0-beta.2
8.0.0-beta.3
8.0.0-beta.4
8.0.0-beta.5
8.0.0-beta.6
8.0.0-beta.7
8.0.0-beta.8
8.0.0-beta.9
8.0.0-rc.0
8.1.0-beta.0
8.1.0-next.1
8.1.0-next.2
8.1.0-next.3
8.1.0-rc.0
8.2.0-next.0
8.2.0-next.1
8.2.0-next.2
9.*
9.0.0-next.0
9.0.0-next.1
9.0.0-next.10
9.0.0-next.11
9.0.0-next.12
9.0.0-next.13
9.0.0-next.14
9.0.0-next.15
9.0.0-next.2
9.0.0-next.3
9.0.0-next.4
9.0.0-next.5
9.0.0-next.6
9.0.0-next.7
9.0.0-next.8
9.0.0-next.9
9.0.0-rc.0
9.0.0-rc.1
9.1.0-next.0
9.1.0-next.1
9.1.0-next.2
9.1.0-next.4
9.1.0-next.5
9.1.0-rc.0
ngcontainer_0.*
ngcontainer_0.3.0
ngcontainer_0.3.1
ngcontainer_0.3.2
ngcontainer_0.3.3
ngcontainer_0.4.0
ngcontainer_0.5.0
Other
patch_sync
v21.*
v21.1.0-next.2
v21.1.0-next.3
v21.1.0-next.4
v21.2.0
v21.2.0-next.0
v21.2.0-next.1
v21.2.0-next.2
v21.2.0-next.3
v21.2.0-rc.0
v21.2.1
v21.2.10
v21.2.11
v21.2.12
v21.2.13
v21.2.14
v21.2.2
v21.2.3
v21.2.4
v21.2.5
v21.2.6
v21.2.7
v21.2.8
v21.2.9
vsix-21.*
vsix-21.2.0
vsix-21.2.1
vsix-21.2.2
vsix-21.2.3
zone.*
zone.js-0.10.0
zone.js-0.10.1
zone.js-0.10.2
zone.js-0.10.3
zone.js-0.11.0
zone.js-0.11.2
zone.js-0.11.3
zone.js-0.11.4
zone.js-0.11.5
zone.js-0.11.6
zone.js-0.11.7
zone.js-0.11.8
zone.js-0.12.0
zone.js-0.13.0
zone.js-0.13.1
zone.js-0.13.2
zone.js-0.13.3
zone.js-0.14.0
zone.js-0.14.1
zone.js-0.14.10
zone.js-0.14.2
zone.js-0.14.3
zone.js-0.14.4
zone.js-0.14.5
zone.js-0.14.6
zone.js-0.14.7
zone.js-0.14.8
zone.js-0.15.0
zone.js-0.15.1
zone.js-0.16.0
zone.js-0.9.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-50178.json"