CVE-2019-18212

PoC —

CVSS 3.1

6.5 medium

EPSS

3%p86

Published

Oct 23, 2019 (Oct 23, 2019)

Modified

Jun 17, 2026

Description

XMLLanguageService.java in XML Language Server (aka lsp4xml) before 0.9.1, as used in Red Hat XML Language Support (aka vscode-xml) before 0.9.1 for Visual Studio and other products, allows a remote attacker to write to arbitrary files via Directory Traversal.

Vendors: xml language server project eclipse theia xml extension project
Products: xml server project, wild web developer, theia xml extension
Weakness: CWE-22
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (2.8%)

In the news0 stories

No ingested article mentions this CVE yet.