N/A

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-32732

CVE-2026-32732: XSS in @leanprover/unicode-input-component

Lean 4 VS Code Extension is a Visual Studio Code extension for the Lean 4 proof assistant. Projects that use @leanprover/unicode-input-component are vulnerable to an XSS exploit in 0.1.9 of the package and lower. The component re-inserted text in the input element back into the input element as unescaped HTML. The issue has been resolved in 0.2.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-32732

CVE-2026-32732:

N/A

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@leanprover/unicode-input-component	npm	< 0.2.0	0.2.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a cross-site scripting (XSS) issue in the @leanprover/unicode-input-component. The root cause is that user-provided input was being rendered as HTML without proper escaping. The component would read text from an input element (innerText), process it, and then write it back to the element's innerHTML. This process failed to sanitize the text, allowing embedded HTML and script tags to be executed.

The patch, identified in commit 14b7a105c89d2819c5e78970fd258393f76453bb, introduces an escapeHtml function to sanitize the input. This function is applied in several key places:

In the replaceAt function, which is responsible for constructing the new HTML string. All parts of the original string are now escaped before being added to the result.
In the InputAbbreviationRewriter.present method, the text to be underlined is now escaped before being wrapped in <u> tags.
In the InputAbbreviationRewriter.replaceAbbreviations method, the newText from a change event is escaped before being incorporated into the updated HTML.

Any of these functions could appear in a runtime profile during an exploit. replaceAt is a central function that processes the untrusted input, while present and replaceAbbreviations are the methods that orchestrate the update and trigger the innerHTML set, making them the primary indicators of the vulnerable operation.

Vulnerable functions

replaceAt

lean4-unicode-input-component/src/index.ts

This function constructs an HTML string from different parts of an input string. Before the patch, it directly concatenated substrings from the user-provided input (`str`) without escaping them. This allowed malicious HTML and script content to be included in the string that was later used to set the `innerHTML` of an element, leading to XSS.

InputAbbreviationRewriter.present

lean4-unicode-input-component/src/index.ts

This method is responsible for presenting abbreviations by wrapping them in `<u>` tags. The `old` string, which is a part of the user-controlled input, was not escaped before being embedded in the HTML string. This method calls `replaceAt` and the result is used to set `innerHTML`, creating an XSS vector.

InputAbbreviationRewriter.replaceAbbreviations

lean4-unicode-input-component/src/index.ts

This method handles text replacement based on change events. The `c.newText` value, which can originate from user input, was used directly in an update function. The result was then passed to `replaceAt` and ultimately used to set `innerHTML` via `setInputHTML`, without prior escaping, thus creating an XSS vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.