Eclipse Foundation Security Team

In Eclipse Langium versions 3.0.0 and later, the langium-sprotty package does not HTML-escape diagnostic messages before rendering them in the default hover popup provided by `addHoverPopupHandler`. If a Langium grammar allows cross-reference text to cont

Unauthenticated memory-exhaustion denial of service in Eclipse Mnestix AAS Generator unbounded count parameter

Improper limitation of paths in py-aspect-model-loader

Keycloak admin client secret stored in cleartext in a ConfigMap in Eclipse BaSyx Helm Charts

Keycloak admin user password stored in cleartext in a ConfigMap in Eclipse BaSyx Helm Charts

Missing server-side authorization in Eclipse Mnestix Browser admin server actions allows unauthenticated configuration tampering

Unauthenticated SSRF with MNESTIX_BACKEND_API_KEY disclosure in Eclipse Mnestix Browser server actions for configured Infrastructures

HmacShaCryptor.Hash never hashes its input — returns constant HMAC_K("") for all inputs, voiding CBC-HMAC JWE integrity

JweDirectDecryptorBlock.Decrypt: unchecked _thales_aad length header reachable with forged tag → index-out-of-range / slice-bounds panic and unbounded allocation

JweRsaKeyEncryptionDecryptorImpl.Decrypt panics on attacker-chosen IV length (stdlib GCM.Open reached without nonce-size check)