Unable to use extensions that depend on unsafe-eval policy, in code-editor
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 52/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- javascript
Research direction
Start by tracing how Code Editor loads CommonJS extensions in the web/worker host and where the CSP policy is configured. Reproduce activation of the vscodevim.vim extension, then verify that it works under the intended policy without the reported EvalError.
Written by the indexing model from the issue text.
Description
Description:
The change in the security policy from unsafe-eval to wasm-unsafe-eval stops JavaScript from turning strings into runnable code.
- Vim is a CommonJS format extension.
- When Code Editor loads a CommonJS extension in the web/worker host, it wraps the code string in a function and executes it.
- In the Code Editor space, the new CSP policy blocks that step, so it fails.
2026-09-10 16:47:24.991 [error] Activating extension vscodevim.vim failed due to an error: 2026-09-10 16:47:24.991 [error] EvalError: Evaluating a string as JavaScript violates the following Content Security Policy directive because 'unsafe-eval' is not an allowed source of script: script-src 'self' 'wasm-unsafe-eval' 'sha256-8VDNIuBNbWfgSAsMFpnaas1UmjLKHwTaKfM2t/FPUfc=' https: http://localhost:* blob:".
https://www.w3.org/TR/CSP3/#directive-script-src
Per the CSP spec, new Function() is gated only on 'unsafe-eval'; 'wasm-unsafe-eval' "only permits WebAssembly and does not affect JavaScript." So replacing 'unsafe-eval' with 'wasm-unsafe-eval' removes the exact permission the extension loader needs, and the browser throws EvalError.
Ticket ID: D523182748
- Dominant language
- Shell
- Stars
- 26
- Forks
- 24
- PR merge metrics
- No merged PRs in 30d
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from aws/code-editor
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
aws/code-editor#266 ·
-
aws/code-editor#248 · 1 comment · 1 assignee ·
Similar issues
-
Issue-Enhancement Needs-Triage
Difficulty 1/5 Under an hour Newbie friendliness 86/100
PowerShell/PowerShell#28061 · 2 reactions ·
-
Feature Request: Add ability to load custom environment variables in linux-exec-server-installer.sh Open
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
microsoft/vscode-remote-release#11867 ·
-
AuTest Bug Tests
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
apache/trafficserver#13714 ·
-
Update to NCCL 2.32 Open
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
conda-forge/nccl-feedstock#166 ·
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
vllm-project/agentic-api#358 · 1 comment ·