{"id":"CVE-2026-118492","published":"2026-11-09T16:17:26.627","lastModified":"2026-11-09T16:17:26.627","description":"In Eclipse Langium versions 3.0.0 and later, the langium-sprotty package does not HTML-escape diagnostic messages before rendering them in the default hover popup provided by `addHoverPopupHandler`. If a Langium grammar allows cross-reference text to contain HTML markup (such as through a STRING terminal), an unresolved cross-reference produces a diagnostic message that includes the literal ref text. When a Sprotty diagram is opened for a malicious source file under these conditions, and a user hovers over the corresponding error marker, attacker-controlled JavaScript can execute in the browser or webview.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://github.com/eclipse-langium/langium/security/advisories/GHSA-7c4f-7qwx-hmcv","tags":[]},{"url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/512","tags":[]},{"url":"https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/1018","tags":[]}],"exploitRefs":[{"url":"https://github.com/eclipse-langium/langium/security/advisories/GHSA-7c4f-7qwx-hmcv","tags":[]}],"hasPoc":true,"ai":null}