GHSA-7c4f-7qwx-hmcv: XSS
In Eclipse Langium versions 3.0.0 and later, the langium-sprotty package does not HTML-escape diagnostic messages before rendering them in the default hover popup provided by addHoverPopupHandler. If a Langium grammar allows cross-reference text to contain HTML markup (such as through a STRING terminal), an unresolved cross-reference produces a diagnostic message that includes the literal ref text. When a Sprotty diagram is opened for a malicious source file under these conditions, and a user hovers over the corresponding error marker, attacker-controlled JavaScript can execute in the browser or webview.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of applications built with Langium 3.0.0 or later that use the langium-sprotty package's default hover popup handler may be exposed. Exploitation additionally requires a grammar that permits HTML markup in cross-reference text, such as via a STRING terminal.
What must an attacker do to trigger the issue?
The attacker needs to provide a malicious source file containing an unresolved cross-reference whose text includes HTML markup. A user must open its Sprotty diagram and hover over the associated error marker for the attacker-controlled JavaScript to execute.
Is interaction required for exploitation?
Yes. The malicious source file must be opened in a Sprotty diagram, and the user must hover over the relevant diagnostic error marker.
What configuration condition determines whether an application is affected?
The vulnerable behavior is in the default hover popup supplied by addHoverPopupHandler. The application is affected only when diagnostic text can incorporate unescaped attacker-controlled cross-reference text containing HTML markup.