{"id":"CVE-2026-118492","aliases":["EUVD-2026-120085","GHSA-7c4f-7qwx-hmcv","GHSA-cw7r-mhgg-m7v3"],"status":"published","title":"In Eclipse Langium versions 3.0.0 and later, the langium-sprotty package does not HTML-escape...","description":"In Eclipse Langium versions 3.0.0 and later, the langium-sprotty package does not HTML-escape diagnostic messages before rendering them in the default hover popup provided by `addHoverPopupHandler`. If a Langium grammar allows cross-reference text to contain HTML markup (such as through a STRING terminal), an unresolved cross-reference produces a diagnostic message that includes the literal ref text. When a Sprotty diagram is opened for a malicious source file under these conditions, and a user hovers over the corresponding error marker, attacker-controlled JavaScript can execute in the browser or webview.","severity":{"version":"4.0","score":2,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/AU:N/R:A/V:D","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-14","score":0.00139,"percentile":0.03334,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-11-09T15:57:23Z","modified":"2026-11-12T16:26:15Z","products":[{"vendor":"eclipse foundation","product":"eclipse langium"}],"references":[{"url":"https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/1018","tags":["web"]},{"url":"https://github.com/eclipse-langium/langium/security/advisories/GHSA-7c4f-7qwx-hmcv","tags":["exploit","advisory"]},{"url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/512","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118492","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-cw7r-mhgg-m7v3"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/118xxx/CVE-2026-118492.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-118492","description":"In Eclipse Langium versions 3.0.0 and later, the langium-sprotty package does not HTML-escape diagnostic messages before rendering them in the default hover popup provided by `addHoverPopupHandler`. If a Langium grammar allows cross-reference text to contain HTML markup (such as through a STRING terminal), an unresolved cross-reference produces a diagnostic message that includes the literal ref text. When a Sprotty diagram is opened for a malicious source file under these conditions, and a user hovers over the corresponding error marker, attacker-controlled JavaScript can execute in the browser or webview.","status":"published","published":"2026-11-09T15:57:23.409Z","modified":"2026-11-12T16:26:15.625Z","cvss":[{"version":"4.0","score":2,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/AU:N/R:A/V:D","level":"low","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-12T17:45:34.376245Z"}],"euvd":[{"id":"EUVD-2026-120085","description":"In Eclipse Langium versions 3.0.0 and later, the langium-sprotty package does not HTML-escape diagnostic messages before rendering them in the default hover popup provided by `addHoverPopupHandler`. If a Langium grammar allows cross-reference text to contain HTML markup (such as through a STRING terminal), an unresolved cross-reference produces a diagnostic message that includes the literal ref text. When a Sprotty diagram is opened for a malicious source file under these conditions, and a user hovers over the corresponding error marker, attacker-controlled JavaScript can execute in the browser or webview.","status":"published","published":"2026-11-09T15:57:23Z","modified":"2026-11-12T16:26:15Z","cvss":[{"version":"4.0","score":2,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/AU:N/R:A/V:D","level":"low"}],"updated_at":"2026-11-09T20:18:01.97518Z"}],"ghsa":[{"id":"GHSA-cw7r-mhgg-m7v3","title":"In Eclipse Langium versions 3.0.0 and later, the langium-sprotty package does not HTML-escape...","description":"In Eclipse Langium versions 3.0.0 and later, the langium-sprotty package does not HTML-escape diagnostic messages before rendering them in the default hover popup provided by `addHoverPopupHandler`. If a Langium grammar allows cross-reference text to contain HTML markup (such as through a STRING terminal), an unresolved cross-reference produces a diagnostic message that includes the literal ref text. When a Sprotty diagram is opened for a malicious source file under these conditions, and a user hovers over the corresponding error marker, attacker-controlled JavaScript can execute in the browser or webview.","status":"published","published":"2026-11-09T18:31:57Z","modified":"2026-11-09T18:32:07Z","cvss":[{"version":"4.0","score":2,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:D/RE:X/U:X","level":"low"}],"cwes":["CWE-79"],"updated_at":"2026-11-09T18:49:19.883486Z"}],"nvd":[{"id":"CVE-2026-118492","description":"In Eclipse Langium versions 3.0.0 and later, the langium-sprotty package does not HTML-escape diagnostic messages before rendering them in the default hover popup provided by `addHoverPopupHandler`. If a Langium grammar allows cross-reference text to contain HTML markup (such as through a STRING terminal), an unresolved cross-reference produces a diagnostic message that includes the literal ref text. When a Sprotty diagram is opened for a malicious source file under these conditions, and a user hovers over the corresponding error marker, attacker-controlled JavaScript can execute in the browser or webview.","status":"published","published":"2026-11-09T16:17:26.627Z","modified":"2026-11-12T20:07:11.09Z","cvss":[{"version":"4.0","score":2,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:D/RE:X/U:X","level":"low","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-12T19:32:18.475158Z"}],"osv":[{"id":"CVE-2026-118492","description":"In Eclipse Langium versions 3.0.0 and later, the langium-sprotty package does not HTML-escape diagnostic messages before rendering them in the default hover popup provided by `addHoverPopupHandler`. If a Langium grammar allows cross-reference text to contain HTML markup (such as through a STRING terminal), an unresolved cross-reference produces a diagnostic message that includes the literal ref text. When a Sprotty diagram is opened for a malicious source file under these conditions, and a user hovers over the corresponding error marker, attacker-controlled JavaScript can execute in the browser or webview.","status":"published","published":"2026-11-09T15:57:23.409Z","modified":"2026-11-14T02:30:32.049996249Z","cvss":[{"version":"4.0","score":2,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/AU:N/R:A/V:D","level":"low"}],"cwes":["CWE-79"],"updated_at":"2026-11-11T03:22:00.901153Z"}]}}