CVE-2026-118492

UNKNOWN 0.0

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

In Eclipse Langium versions 3.0.0 and later, the langium-sprotty package does not HTML-escape diagnostic messages before rendering them in the default hover popup provided by `addHoverPopupHandler`. If a Langium grammar allows cross-reference text to contain HTML markup (such as through a STRING terminal), an unresolved cross-reference produces a diagnostic message that includes the literal ref text. When a Sprotty diagram is opened for a malicious source file under these conditions, and a user hovers over the corresponding error marker, attacker-controlled JavaScript can execute in the browser or webview.

CWE	CWE-79
Vendor	eclipse foundation
Product	eclipse langium
Published	Nov 9, 2026

Stay Ahead of the Next One

Get instant alerts for eclipse foundation eclipse langium

Be the first to know when new unknown vulnerabilities affecting eclipse foundation eclipse langium are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Eclipse Foundation / Eclipse Langium

3.0.0 ≤ 4.4.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

gitlab.eclipse.org: https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/1018 github.com: https://github.com/eclipse-langium/langium/security/advisories/GHSA-7c4f-7qwx-hmcv gitlab.eclipse.org: https://gitlab.eclipse.org/security/cve-assignment/-/work_items/512

Credits

Eclipse Foundation Security Team