CVE-2026-32732 NONE

CVE-2026-32732: XSS in @leanprover/unicode-input-component

Vendor Leanprover
Product vscode-lean4
Weakness CWE-80 · XSS · basic
Published March 13, 2026
Last update March 16, 2026
View on NVD All CVEs

CVSS base score

0.0/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Lean 4 VS Code Extension is a Visual Studio Code extension for the Lean 4 proof assistant. Projects that use @leanprover/unicode-input-component are vulnerable to an XSS exploit in 0.1.9 of the package and lower. The component re-inserted text in the input element back into the input element as unescaped HTML. The issue has been resolved in 0.2.0.

Key dates

02Disclosure timeline

March 13, 2026 CVE published
March 16, 2026 Record updated