A critical vulnerability in the vscode-spell-checker extension enables attackers to execute arbitrary Node.js code with user privileges by tricking users into opening a compromised workspace.

The extension improperly handles the cSpell.trustedWorkspace configuration flag, which allows untrusted workspaces to execute malicious JavaScript or TypeScript configuration files. This flaw relies on untrusted input to make security decisions, effectively bypassing VS Code workspace trust protections and granting an attacker code execution capabilities.

The ability to execute arbitrary code with the privileges of the local user poses a significant risk to organizational security. An attacker could leverage this to steal sensitive source code, exfiltrate environment variables, or establish persistence on developer workstations. Given the CVSS score of 7.8, this represents a high-severity threat that could lead to full system compromise if a developer opens a malicious repository.

Immediate Action: Update the vscode-spell-checker extension to version 4.5.4 or later immediately.

Proactive Monitoring: Monitor developer workstation logs for unexpected child process creation or unauthorized file access originating from the VS Code extension host.

Compensating Controls: Avoid opening untrusted or unknown VS Code workspaces until the extension has been updated, and ensure that VS Code workspace trust settings are strictly enforced.

Public Exploit Available: No (There is no confirmed public exploit or weaponized module available in the provided data).

This vulnerability is highly dangerous for development environments, as it targets the trust model of the IDE itself. All teams using the vscode-spell-checker extension should prioritize updating to version 4.5.4 or higher across all developer workstations to prevent potential remote code execution. Failure to patch this issue leaves development environments vulnerable to supply chain attacks and credential theft.