CVE-2026-25931 | streetsidesoftware vscode-spell-checker up to 4.5.3 package.json cSpell.trustedWorkspace default permission (GHSA-mggq-68mr-58vj)

A vulnerability was found in streetsidesoftware vscode-spell-checker up to 4.5.3 and classified as critical. This vulnerability affects unknown code of the file package.json. Such manipulation of the argument cSpell.trustedWorkspace leads to incorrect default permissions.

This vulnerability is uniquely identified as CVE-2026-25931. Local access is required to approach this attack. No exploit exists.

It is suggested to upgrade the affected component.