High · published February 9, 2026
⚠️ An untrusted workspace could be your worst nightmare! Before v4.5.4, the vscode-spell-checker blindly trusted configuration flags, like a bouncer letting in anyone with a fake ID. 🕵️♂️ Think of it like a restaurant that only checks the name on a reservation list. If someone slips in with a forged name, they can access the kitchen and mess with the recipes. In this case, a malicious .cspell.config.js file can execute unwanted Node.js code, putting your system at risk. An attacker could craft a malicious configuration file and execute their code with the same privileges as the user, potentially leading to a full compromise of the system. This could allow unauthorized access to files, data breaches, or even the installation of more malicious software.
Think of it like a restaurant that only checks the name on a reservation list. If someone slips in with a forged name, they can access the kitchen and mess with the recipes. In this case, a malicious .cspell.config.js file can execute unwanted Node.js code, putting your system at risk. The vulnerability arises because the vscode-spell-checker relies on the cSpell.trustedWorkspace setting without verifying the workspace trust state, allowing untrusted configurations to be executed as trusted code.
An attacker could craft a malicious configuration file and execute their code with the same privileges as the user, potentially leading to a full compromise of the system. This could allow unauthorized access to files, data breaches, or even the installation of more malicious software. Upgrade to version 4.5.4 of the vscode-spell-checker immediately. Review all current workspace settings and ensure that any workspace you open is trusted. Additionally, educate your team about the risks of untrusted workspaces and the importance of careful configuration management. You've got this! With a quick update and some vigilance, you can secure your development environment and keep those pesky vulnerabilities at bay! 🛡️