TeXlyre EUVD-2026-116036

Exploitation requires a victim to actively import an attacker-supplied LSP/typesetter recipe through Settings → Import (file upload, URL fetch, or pasted JSON) where the recipe's free-form 'icon' field carries HTML/JavaScript such as an event handler; the payload executes when the tool-settings card is rendered and persists in the user's stored settings. It is scoped to the direct import path only - the real-time collaboration/awareness share path is NOT exploitable because it deletes the 'icon' field during canonicalization. Affected versions are 0.11.0 through 0.13.4 (fixed in 0.13.5). The decisive limiting factor is the required user interaction: the attack cannot fire without the user choosing to import a malicious recipe, so it depends on social engineering around TeXlyre's recipe-sharing feature rather than unattended remote triggering.

This is a moderate, conditional risk rather than an urgent one. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N, base 5.3) shows an unauthenticated (PR:N), low-complexity network vector gated by required user interaction (UI:P) - the victim must deliberately import an attacker-supplied recipe, which is the single most important limiting factor. No EPSS score and no CISA KEV status were provided; absence of these is not itself evidence of safety, but there is no signal of active exploitation. The GHSA advisory supplies a detailed manual reproduction plus an automated Jest/jsdom test, so working exploit detail is public even though the input does not carry an explicit 'POC: Publicly available (confirmed)' flag. The vuln.today decision label is 'this_month', consistent with a real-but-not-emergency priority. Note a tension worth flagging: the assigned CVSS impacts are Low (VC:L/VI:L), yet the vendor describes the real consequence as High - reading/exfiltrating all IndexedDB project documents and reaching in-memory Git backup tokens (GitHub/GitLab/Gitea/Codeberg), which can escalate to repository compromise. If those tokens are present, actual confidentiality/integrity impact is understated by the Low rating. Overall: a genuine stored-XSS issue worth patching this cycle, but its spread depends entirely on social engineering (getting a user to import a malicious recipe) rather than mass, unattended exploitation.

An attacker publishes or shares an LSP/typesetter recipe JSON whose 'icon' field contains an HTML event handler (e.g. an <img src=x onerror=...> payload) and persuades a TeXlyre user to import it via Settings → Import (file, URL, or pasted JSON). When the tool-settings card renders the recipe, the icon is written with dangerouslySetInnerHTML and the script executes in the TeXlyre origin, re-firing each time settings are shown. A public proof of concept exists in the GHSA advisory (both a manual reproduction and an automated Jest test); it is not independently verified as working exploit code here, but it is detailed and demonstrates the sink firing.