Description
In Eclipse Langium versions 3.0.0 and later, the langium-sprotty package does not HTML-escape diagnostic messages before rendering them in the default hover popup provided by `addHoverPopupHandler`. If a Langium grammar allows cross-reference text to contain HTML markup (such as through a STRING terminal), an unresolved cross-reference produces a diagnostic message that includes the literal ref text. When a Sprotty diagram is opened for a malicious source file under these conditions, and a user hovers over the corresponding error marker, attacker-controlled JavaScript can execute in the browser or webview.
Published: 2026-11-09
Score: 2 Low
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 09 Nov 2026 17:45:00 +0000

Type Values Removed Values Added
Title Unescaped Diagnostic Messages Enable JavaScript Execution in Eclipse Langium Hover Popups

Mon, 09 Nov 2026 16:15:00 +0000

Type Values Removed Values Added
Description In Eclipse Langium versions 3.0.0 and later, the langium-sprotty package does not HTML-escape diagnostic messages before rendering them in the default hover popup provided by `addHoverPopupHandler`. If a Langium grammar allows cross-reference text to contain HTML markup (such as through a STRING terminal), an unresolved cross-reference produces a diagnostic message that includes the literal ref text. When a Sprotty diagram is opened for a malicious source file under these conditions, and a user hovers over the corresponding error marker, attacker-controlled JavaScript can execute in the browser or webview.
Weaknesses CWE-79
References
Metrics cvssV4_0

{'score': 2, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/AU:N/R:A/V:D'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: eclipse

Published:

Updated: 2026-11-09T15:57:23.409Z

Reserved: 2026-10-28T11:37:34.094Z

Link: CVE-2026-118492

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-09T16:17:26.627

Modified: 2026-11-09T16:17:26.627

Link: CVE-2026-118492

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-09T17:30:08Z

Weaknesses