{"affected":[{"defaultStatus":"unaffected","product":"Eclipse Langium","source":"CNA: eclipse","vendor":"Eclipse Foundation","versions":[{"lessThanOrEqual":"4.4.0","status":"affected","version":"3.0.0","versionType":"semver"}]}],"cveId":"CVE-2026-118492","cwes":["CWE-79"],"description":"In Eclipse Langium versions 3.0.0 and later, the langium-sprotty package does not HTML-escape diagnostic messages before rendering them in the default hover popup provided by `addHoverPopupHandler`. If a Langium grammar allows cross-reference text to contain HTML markup (such as through a STRING terminal), an unresolved cross-reference produces a diagnostic message that includes the literal ref text. When a Sprotty diagram is opened for a malicious source file under these conditions, and a user hovers over the corresponding error marker, attacker-controlled JavaScript can execute in the browser or webview.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":2,"severity":"low","source":"CNA: eclipse","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/AU:N/R:A/V:D","version":"4.0"}],"modifiedAt":1794239843409,"publishedAt":1794239843409,"references":[{"source":"CNA: eclipse","tags":[],"url":"https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/1018"},{"source":"CNA: eclipse","tags":[],"url":"https://github.com/eclipse-langium/langium/security/advisories/GHSA-7c4f-7qwx-hmcv"},{"source":"CNA: eclipse","tags":[],"url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/512"}],"remediation":[],"revision":"e5fce75e43ada40e2218743349e8879521ed038aeb8791e012213fa2d1709e30","sources":[{"modifiedAt":1794239843409,"name":"CNA: eclipse","retrievedAt":1794240516813,"url":"https://www.cve.org/CVERecord?id=CVE-2026-118492"}],"ssvc":null,"status":"published","title":"CVE-2026-118492","updatedAt":1794240516813}