XSS Vulnerability in Lean 4 VS Code Extension for Visual Studio Code

CVE-2026-32732

What is CVE-2026-32732?

The Lean 4 VS Code Extension, a tool for the Lean 4 proof assistant, is susceptible to a Cross-Site Scripting (XSS) vulnerability due to improper handling of input from the @leanprover/unicode-input-component. In versions 0.1.9 and earlier, the extension re-inserted text into an input element without escaping it as HTML. This flaw allows malicious actors to inject and execute arbitrary scripts in the context of a user's session. The issue has been addressed in version 0.2.0 of the package, which implements proper escaping to mitigate the risk.

References