PT-2026-25402 · Unknown · Lean 4 Vs Code Extension+1

Mhuisi · Published 2026-03-13 · Updated 2026-03-16 · CVE-2026-32732

Positive Technologies (AI Summary)

CVSS v4.0

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Lean 4 VS Code Extension versions 0.1.9 and lower @leanprover/unicode-input-component versions 0.1.9 and lower

Description Projects utilizing the @leanprover/unicode-input-component are susceptible to a cross-site scripting (XSS) issue. The component improperly handles input, re-inserting text into the input element as unescaped HTML. This allows for the injection of malicious scripts. The issue is present in version 0.1.9 and earlier of the component.

Recommendations Update @leanprover/unicode-input-component to version 0.2.0 or later. As a workaround, replace the unicode input component with a basic HTML text field.

Fix

XSS

Weakness Enumeration

CWE-80

Related Identifiers

CVE-2026-32732

GHSA-6GGM-PWR9-R5H2

Affected Products

@Leanprover/Unicode-Input-Component

Lean 4 Vs Code Extension

References · 10

• https://osv.dev/vulnerability/GHSA-6ggm-pwr9-r5h2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32732 · Security Note
• https://github.com/leanprover/vscode-lean4 · Note
• https://github.com/leanprover/vscode-lean4/security/advisories/GHSA-6ggm-pwr9-r5h2 · Note
• https://github.com/leanprover/vscode-lean4/pull/735 · Note
• https://t.me/CVEtracker/47397 · Telegram Post
• https://twitter.com/CVEnew/status/2032605812024082662 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1rvkawc/resumen_diario_de_vulnerabilidades_16032026 · Reddit Post
• https://twitter.com/cyberbivash/status/2032590048881758562 · Twitter Post
• https://leanprover.zulipchat.com/#narrow/channel/113488-general/topic/weird.20behavior.20in.20loogle.20searchbar/near/578502003 · Note