@0xabad1dea@infosec.exchange most programming languages will start an lsp server when trusting a folder and almost every language out there has a way to run arbitrary code at "compile time" (whatever compile time means depending on that language), so that's another way to exploit this