XSS in @leanprover/unicode-input-component
Date: 2026-03
Affected: npm/@leanprover/unicode-input-component
Attack vector: xss
Category: vulnerability-disclosure
Severity: Low
CVE: CVE-2026-32732
CWE: CWE-80

### Impact Projects that use [@leanprover/unicode-input-component](https://www.npmjs.com/package/@leanprover/unicode-input-component) are vulnerable to an XSS exploit in 0.1.9 of the package and lower. The component re-inserted text in the input element back into the input element as unescaped HTML. ### Patches The issue has been resolved in 0.2.0. ### Workarounds Replace the unicode input component with a basic HTML text field.


Mitigations:

Architectural layers (MAESTRO):