Description:
The change in the security policy from unsafe-eval to wasm-unsafe-eval stops JavaScript from turning strings into runnable code.
- Vim is a CommonJS format extension.
- When Code Editor loads a CommonJS extension in the web/worker host, it wraps the code string in a function and executes it.
- In the Code Editor space, the new CSP policy blocks that step, so it fails.
2026-09-10 16:47:24.991 [error] Activating extension vscodevim.vim failed due to an error: 2026-09-10 16:47:24.991 [error] EvalError: Evaluating a string as JavaScript violates the following Content Security Policy directive because 'unsafe-eval' is not an allowed source of script: script-src 'self' 'wasm-unsafe-eval' 'sha256-8VDNIuBNbWfgSAsMFpnaas1UmjLKHwTaKfM2t/FPUfc=' https: http://localhost:* blob:".
https://www.w3.org/TR/CSP3/#directive-script-src
Per the CSP spec, new Function() is gated only on 'unsafe-eval'; 'wasm-unsafe-eval' "only permits WebAssembly and does not affect JavaScript." So replacing 'unsafe-eval' with 'wasm-unsafe-eval' removes the exact permission the extension loader needs, and the browser throws EvalError.
Ticket ID: D523182748
Description:
The change in the security policy from
unsafe-evaltowasm-unsafe-evalstops JavaScript from turning strings into runnable code.2026-09-10 16:47:24.991 [error] Activating extension vscodevim.vim failed due to an error: 2026-09-10 16:47:24.991 [error] EvalError: Evaluating a string as JavaScript violates the following Content Security Policy directive because 'unsafe-eval' is not an allowed source of script: script-src 'self' 'wasm-unsafe-eval' 'sha256-8VDNIuBNbWfgSAsMFpnaas1UmjLKHwTaKfM2t/FPUfc=' https: http://localhost:* blob:".https://www.w3.org/TR/CSP3/#directive-script-src
Per the CSP spec, new Function() is gated only on 'unsafe-eval'; 'wasm-unsafe-eval' "only permits WebAssembly and does not affect JavaScript." So replacing 'unsafe-eval' with 'wasm-unsafe-eval' removes the exact permission the extension loader needs, and the browser throws EvalError.
Ticket ID: D523182748