GitHub Advisoryadvisory · npm

GHSA-6ggm-pwr9-r5h2 XSS in @leanprover/unicode-input-component

LOW Published 2026-03-16 Modified 2026-03-16 Official page ↗
Aliases
CVE-2026-32732
Ecosystem
npm
Packages
@leanprover/unicode-input-component
Severity
Low
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-80
Reviewed
2026-03-16

Affected packages

• npm @leanprover/unicode-input-component: < 0.2.0 → fixed in 0.2.0

Description

Impact Projects that use @leanprover/unicode-input-component are vulnerable to an XSS exploit in 0.1.9 of the package and lower. The component re-inserted text in the input element back into the input element as unescaped HTML. Patches The issue has been resolved in 0.2.0. Workarounds Replace the unicode input component with a basic HTML text field.

Related

Alias · CVE (1)

  • CVE-2026-32732 Lean 4 VS Code Extension is a Visual Studio Code extension for the Lean 4 proof assistant. vulnerability

Weakness · CWE (1)

  • CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page weakness

References