CVE-2026-118492 · Package
NO FIX YET
The langium-sprotty package inserts diagnostic messages into the hover popup without HTML escaping, so markup in cross-reference text is rendered. If a user opens a malicious source file in a Sprotty diagram and hovers over the error marker, attacker JavaScript can run in the browser or webview.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that use langium-sprotty 3.0.0 or later with a grammar that lets cross-reference text contain HTML, and that render diagrams for untrusted source files. Projects that do not use langium-sprotty or the default hover popup are not affected. The sources do not give a fixed version.
Not affected if custom-hover-popup, no-langium-sprotty, trusted-source-files-only
Who cares eclipse-langium, langium, langium-sprotty, vscode-extensions
langium-sprotty from version 3.0.0 or later.addHoverPopupHandler is used to show diagnostics.No fix yet, per the sources.
In Eclipse Langium versions 3.0.0 and later, the langium-sprotty package does not HTML-escape diagnostic messages before rendering them in the default hover popup provided by addHoverPopupHandler. If a Langium grammar allows cross-reference text to contain HTML markup (such as through a STRING terminal), an unresolved cross-reference produces a diagnostic message that includes the literal ref text. When a Sprotty diagram is opened for a malicious source file under these conditions, and a user hovers over the corresponding error marker, attacker-controlled JavaScript can execute in the browser or webview.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:D/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.