CVE-2026-32732: Lean 4 VS Code Extension XSS Vulnerability

CVE-2026-32732 Overview

CVE-2026-32732 is a Cross-Site Scripting (XSS) vulnerability affecting the @leanprover/unicode-input-component package used by the Lean 4 VS Code Extension. The vulnerability exists in versions 0.1.9 and earlier of the package, where the component re-inserts text into input elements as unescaped HTML, enabling malicious script execution.

Critical Impact

Projects utilizing the vulnerable unicode-input-component may be susceptible to XSS attacks, allowing attackers to execute arbitrary JavaScript code in the context of the user's browser session when interacting with affected input fields.

Affected Products

• @leanprover/unicode-input-component versions ≤ 0.1.9
• Lean 4 VS Code Extension (vscode-lean4) using vulnerable component versions
• Any project integrating the affected unicode-input-component package

Discovery Timeline

• 2026-03-16 - CVE-2026-32732 published to NVD
• 2026-03-16 - Last updated in NVD database

Technical Details for CVE-2026-32732

Vulnerability Analysis

This vulnerability is classified under CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page - Basic XSS). The core issue stems from the unicode-input-component's handling of user-supplied text within input elements.

When users interact with the component, text entered into the input field is processed and re-inserted into the DOM. However, in vulnerable versions, this re-insertion occurs without proper HTML escaping or sanitization. This creates an opportunity for attackers to inject malicious HTML or JavaScript code that will be executed when the component processes the input.

The attack requires user interaction, as the victim must interact with an input field containing the malicious payload. Once triggered, the injected script executes within the security context of the application, potentially enabling session hijacking, credential theft, or other malicious activities.

Root Cause

The root cause of this vulnerability is improper output encoding in the unicode-input-component. The component failed to sanitize or escape user-provided text before re-inserting it into the DOM as HTML content. This violates the fundamental security principle of treating all user input as untrusted and ensuring proper encoding before rendering in the browser context.

Attack Vector

The vulnerability is exploitable via the network, requiring user interaction with a malicious input payload. An attacker could craft specially formatted input containing HTML tags or JavaScript event handlers. When this input is processed by the vulnerable component, the malicious content is rendered as executable code rather than being displayed as literal text.

The attack scenario involves injecting script elements or event handlers (such as <img src=x onerror=alert(1)>) into input fields processed by the vulnerable component. Since the component re-inserts text without escaping, these elements execute in the victim's browser context.

Detection Methods for CVE-2026-32732

Indicators of Compromise

• Unexpected JavaScript execution or alerts when interacting with unicode input fields
• Unusual network requests originating from the VS Code extension context
• Reports of phishing-like behavior or credential prompts within the Lean 4 development environment

Detection Strategies

• Review package.json and package-lock.json files for @leanprover/unicode-input-component versions 0.1.9 or earlier
• Implement Content Security Policy (CSP) headers to detect and prevent inline script execution
• Monitor browser console logs for XSS-related errors or warnings when using the Lean 4 extension

Monitoring Recommendations

• Enable security auditing in your package manager (e.g., npm audit) to identify vulnerable dependencies
• Configure browser developer tools to alert on suspicious DOM modifications
• Review extension logs for anomalous behavior patterns during unicode input processing

How to Mitigate CVE-2026-32732

Immediate Actions Required

• Update @leanprover/unicode-input-component to version 0.2.0 or later immediately
• Update the Lean 4 VS Code Extension to the latest version that includes the patched component
• Audit any custom implementations using the vulnerable package version

Patch Information

The vulnerability has been resolved in version 0.2.0 of the @leanprover/unicode-input-component package. The fix implements proper HTML escaping when re-inserting text into input elements, preventing malicious code from being interpreted as executable content. For detailed information about the fix, refer to the GitHub Pull Request and the GitHub Security Advisory.

Workarounds

• Avoid using affected versions of the unicode-input-component in production environments until patching is possible
• Implement application-level input sanitization as a defense-in-depth measure
• Consider temporarily disabling features that rely on the vulnerable component if immediate upgrade is not feasible

# Update the vulnerable package to patched version
npm update @leanprover/unicode-input-component@0.2.0

# Verify the installed version
npm list @leanprover/unicode-input-component

# Run security audit to confirm remediation
npm audit