diff --git a/src/vs/workbench/parts/webview/electron-browser/webview-pre.js b/src/vs/workbench/parts/webview/electron-browser/webview-pre.js
index <HASH>..<HASH> 100644
--- a/src/vs/workbench/parts/webview/electron-browser/webview-pre.js
+++ b/src/vs/workbench/parts/webview/electron-browser/webview-pre.js
@@ -172,7 +172,7 @@
 			}
 
 			// apply default script
-			if (enableWrappedPostMessage) {
+			if (enableWrappedPostMessage && options.allowScripts) {
 				const defaultScript = newDocument.createElement('script');
 				defaultScript.textContent = `
 					const acquireVsCodeApi = (function() {
Don't try injecting vscode api into webviews that have scripts disabled

Fixes #<I>