CVE-2026-32732

Name: CVE-2026-32732 — Vulnerability Record
Brand: Quanteta Data Lab
SKU: CVE-2026-32732

NONE

CVSS v4.0: 0.0 · EPSS: 0.0006 (19.8 percentile)

NetworkNo privilegesXSSVendor advisory ref

Source data as of: 2026-04-17 06:05:21 UTC

At a glance

Severity: NONE
CVSS: 0.0 v4.0 · NVD
EPSS: 0.0006 (19.8 percentile) · FIRST.org
CISA KEV: No
Type: XSS · NVD CWE
Attack conditions (CVSS vector): NetworkNo privileges · Source: NVD Vector
Published: 2026-03-16 · Modified: 2026-04-16
References: Jump to references (3)

CVSS / EPSS / KEV

CVSS v4.0 0.0 / 10 NONE Source: NVD

EPSS 0.0006 19.8 percentile Source: FIRST.org

CISA KEV No Source: CISA

Source — CVSS: NVD · EPSS: FIRST.org · KEV: CISA. Data & Sources

Description

Lean 4 VS Code Extension is a Visual Studio Code extension for the Lean 4 proof assistant. Projects that use @leanprover/unicode-input-component are vulnerable to an XSS exploit in 0.1.9 of the package and lower. The component re-inserted text in the input element back into the input element as unescaped HTML. The issue has been resolved in 0.2.0.

Record details

CVE ID: CVE-2026-32732
CVSS (v4.0): 0.0 (NONE)
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS: 0.0006 (19.8 percentile) — 2026-04-17
CISA KEV: No
Weakness (CWE): CWE-80
Affected configurations (CPE): 0
Published: 2026-03-16
Modified: 2026-04-16
Status: Deferred

References

Reference URLs as listed by NVD, grouped by a mechanical match on the link's host/pattern. Labels describe the link type only.

← Back to all records