Improper Input Validation in Eclipse Langium's Sprotty Package

CVE-2026-118492

What is CVE-2026-118492?

In Eclipse Langium versions 3.0.0 and later, the langium-sprotty package fails to properly HTML-escape diagnostic messages prior to rendering them in the default hover popup. This issue arises when a Langium grammar permits cross-reference text that contains HTML markup (commonly via a STRING terminal). As a result, if an unresolved cross-reference occurs, the diagnostic message will include raw reference text. If a Sprotty diagram is displayed for a malicious source file under such conditions, hovering over the related error marker can trigger the execution of attacker-controlled JavaScript in the user's browser or webview, posing a significant security risk.

References