Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-118492

Quick assessment

Affected
Eclipse Foundation Eclipse Langium
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Eclipse Langium 3.0.0 及更高版本中， 包在通过 提供的默认悬停提示中渲染诊断消息时，未对消息进行 HTML 转义。如果 Langium 文法允许跨引用文本包含 HTML 标记（例如通过 终结符），则未解析的跨引用会生成一条包含原始引用文本的诊断消息。在此条件下，当用户打开一个恶意源文件对应的 Sprotty 图表，并将鼠标悬停在相应的错误标记上时，攻击者控制的 JavaScript 代码将在浏览器或 Web 视图中执行。

CVSS 2.0 · Low

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
Eclipse Foundation Eclipse Langium 3.0.0≤ 4.4.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-118492

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
In Eclipse Langium versions 3.0.0 and later, the langium-sprotty package does not HTML-escape diagnostic messages before rendering them in the default hover popup provided by `addHoverPopupHandler`. If a Langium grammar allows cross-reference text to contain HTML markup (such as through a STRING terminal), an unresolved cross-reference produces a diagnostic message that includes the literal ref text. When a Sprotty diagram is opened for a malicious source file under these conditions, and a user hovers over the corresponding error marker, attacker-controlled JavaScript can execute in the browser or webview.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/AU:N/R:A/V:D
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Eclipse Foundation Eclipse Langium 3.0.0 ~ 4.4.0 -

II. Public POCs for CVE-2026-118492

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-118492

请登录查看更多情报信息。

Other References for CVE-2026-118492 (3)

Same Patch Batch · Eclipse Foundation · 2026-11-09 · 3 CVEs total

CVE-2026-123870 9.5 CRITICAL [Eclipse CSI - otterdog] Unauthenticated remote code execution via eval() on format-string
CVE-2026-124683 8.7 HIGH Eclipse Langium 3.2.0-4.4.0 正则解析拒绝服务漏洞

IV. Related Vulnerabilities

Same product: Eclipse Langium
Same vendor: Eclipse Foundation
Same weakness: CWE-79