CVE-2026-32732noneCWE-80

CVE-2026-32732: fallo en leanprover vscode-lean4

XSS in @leanprover/unicode-input-component

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear vscode-lean4+ Monitorear @leanprover/unicode-input-component

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

3Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 0epss 0.3%
Lean 4 VS Code Extension is a Visual Studio Code extension for the Lean 4 proof assistant. Projects that use @leanprover/unicode-input-component are vulnerable to an XSS exploit in 0.1.9 of the package and lower. The component re-inserted text in the input element back into the input element as unescaped HTML. The issue has been resolved in 0.2.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N
Productos afectados
leanprover · vscode-lean4