AIKIDO-2026-112580
monaco-editor is vulnerable to Cross-Site Scripting (XSS)
59
Medium Risk
This Affects:
monaco-editorTL;DR
The native LSP client adapters bundled in monaco-editor convert hover, completion, signature help, and inlay hint content returned by language servers into Markdown that is marked as trusted. Trusted Markdown in the editor permits command links and additional HTML, so a malicious or compromised language server can return content that runs editor commands or injects markup when a user views those UI surfaces. This lets untrusted language-server responses render in a trusted context. The fix stops marking language-server Markdown as trusted so it is rendered as untrusted.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and connect the editor to a language server through the native LSP client integration.
Background info
monaco-editor is vulnerable to Cross-Site Scripting (XSS) in versions 0.55.0 - 0.55.1.
How to fix this
Upgrade the monaco-editor library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant