CVE-2026-118492

In Eclipse Langium versions 3.0.0 and later, the langium-sprotty package does not HTML-escape diagnostic messages before rendering them in the default hover popup provided by `addHoverPopupHandler`. If a Langium grammar allows cross-reference text to contain HTML markup (such as through a STRING terminal), an unresolved cross-reference produces a diagnostic message that includes the literal ref text. When a Sprotty diagram is opened for a malicious source file under these conditions, and a user hovers over the corresponding error marker, attacker-controlled JavaScript can execute in the browser or webview.

• https://github.com/eclipse-langium/langium/security/advisories/GHSA-7c4f-7qwx-hmcv

• https://github.com/eclipse-langium/langium/security/advisories/GHSA-7c4f-7qwx-hmcv
• https://gitlab.eclipse.org/security/cve-assignment/-/work_items/512
• https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/1018

• MEDIUMCVE-2012-20003PoC
• MEDIUMCVE-2012-20004PoC
• MEDIUMCVE-2012-20005PoC
• MEDIUMCVE-2013-20009PoC
• MEDIUMCVE-2014-125131PoC
• MEDIUMCVE-2014-125132PoC
• MEDIUMCVE-2015-20130PoC
• MEDIUMCVE-2016-20098PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.