CVE-2019-18212: Eclipse Wild Web Developer

Medium severity, CVSS 6.5. EPSS: 2.8% chance of exploitation in the next 30 days.

XMLLanguageService.java in XML Language Server (aka lsp4xml) before 0.9.1, as used in Red Hat XML Language Support (aka vscode-xml) before 0.9.1 for Visual Studio and other products, allows a remote attacker to write to arbitrary files via Directory Traversal.

Affected products

• Eclipse Wild Web Developer: affected versions not specified
• Theia XML Extension Project Theia XML Extension: affected versions not specified
• XML Language Server Project XML Server Project: before 0.9.1 (fixed in 0.9.1)

Published 2019-10-23. Last modified 2026-06-17.