A stored cross-site scripting issue exists where attackers can execute scripts by providing malicious LSP or typesetter recipe icons. By tricking victims into importing a recipe containing an HTML event handler in its icon, attackers can persistently access local projects and repository credentials.