---
id: "CVE-2026-118492"
page: "https://infrastack.ai/live/CVE-2026-118492"
kind: "vulnerability"
aliases: ["CVE-2026-118492"]
title: "Langium langium-sprotty: unescaped diagnostic messages allow script run on hover"
severity: "low"
cvss: 2.0
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["eclipse-langium", "langium", "langium-sprotty", "package", "vscode-extensions"]
not_affected_if: ["custom-hover-popup", "no-langium-sprotty", "trusted-source-files-only"]
published_at: "2026-11-09T16:17:26+00:00"
first_seen_at: "2026-11-09T16:27:26+00:00"
updated_at: "2026-11-09T16:28:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118492", "first_seen_at": "2026-11-09T16:27:26+00:00"}]
exploit_sources: []
---

# Langium langium-sprotty: unescaped diagnostic messages allow script run on hover

Link for people: https://infrastack.ai/live/CVE-2026-118492 (this .md is for agents)

The langium-sprotty package inserts diagnostic messages into the hover popup without HTML escaping, so markup in cross-reference text is rendered. If a user opens a malicious source file in a Sprotty diagram and hovers over the error marker, attacker JavaScript can run in the browser or webview.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the project depends on `langium-sprotty` from version `3.0.0` or later.
- Check whether the Langium grammar allows STRING terminals to feed cross-reference text.
- Check whether `addHoverPopupHandler` is used to show diagnostics.

## Timeline

- 2026-11-09T16:27:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118492

## Documents

- [advisory] Vendor advisory: github.com https://github.com/eclipse-langium/langium/security/advisories/GHSA-7c4f-7qwx-hmcv

## From the sources

In Eclipse Langium versions 3.0.0 and later, the langium-sprotty package does not HTML-escape diagnostic messages before rendering them in the default hover popup provided by `addHoverPopupHandler`. If a Langium grammar allows cross-reference text to contain HTML markup (such as through a STRING terminal), an unresolved cross-reference produces a diagnostic message that includes the literal ref text. When a Sprotty diagram is opened for a malicious source file under these conditions, and a user hovers over the corresponding error marker, attacker-controlled JavaScript can execute in the browser or webview.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_