The flaw in Eclipse Langium’s langium‑sprotty component fails to HTML‑escape diagnostic messages shown in the default hover popup. When a grammar accepts cross‑reference text that can contain HTML, an unresolved reference results in a diagnostic message that embeds the raw ref text. If a user opens a malicious file in a Sprotty diagram and hovers over the error marker, attacker‑controlled JavaScript can execute in the browser or webview, allowing the attacker to run arbitrary code in the victim’s context. This is a CWE‑79 Cross‑Site Scripting vulnerability.

The vulnerability affects all Eclipse Langium versions 3.0.0 and later distributed by the Eclipse Foundation.

The CVSS score of 2.0 indicates a low severity, mainly because exploitation requires an attacker‑controlled file and a user action of hovering over the marker. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Even with these mitigations, an attacker could execute arbitrary JavaScript within the user’s browser or webview, but will need the victim to open the malicious file. No public exploits have been reported.