@theia/messages

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

Medium 6.1

CVE-2021-28162

Command Injection in @theia/messages

In Eclipse Theia versions up to and including 0.16.0, in the notification messages there is no HTML escaping, so Javascript code can run.

The Eclipse Foundation Eclipse Theia @theia/messages npm

Mar 12, 2021