Eclipse Theia

6 results · Feed

• Unscored —
  CVE-2021-34436

  In Eclipse Theia 0.1.1 to 0.2.0, it is possible to exploit the default build to obtain remote code execution (and XXE) …

  The Eclipse Foundation Eclipse Theia
  Sep 2, 2021
• High 8.8
  CVE-2021-34435

  Remote code execution in Eclipse Theia

  In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside the IDE. But with the way it is made it is possible for a previewed HTML file to trigger an RCE. This exploit only happens if a user previews…

  The Eclipse Foundation Eclipse Theia @theia/mini-browser npm
  Sep 1, 2021
• Medium 6.1
  CVE-2021-28162

  Command Injection in @theia/messages

  In Eclipse Theia versions up to and including 0.16.0, in the notification messages there is no HTML escaping, so Javascript code can run.

  The Eclipse Foundation Eclipse Theia @theia/messages npm
  Mar 12, 2021
• Medium 6.1
  CVE-2021-28161

  Improper Neutralization of Input in Theia console

  In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be injected.

  The Eclipse Foundation Eclipse Theia @theia/console npm
  Mar 12, 2021
• Critical 9.6
  CVE-2020-27224

  Cross-site Scripting (XSS) in Eclipse Theia

  In Eclipse Theia versions up to and including 1.2.0, the Markdown Preview (@theia/preview), can be exploited to execute arbitrary code.

  The Eclipse Foundation Eclipse Theia @theia/preview npm
  Feb 24, 2021
• High 8.1
  CVE-2019-17636

  Insufficient Verification of Data Authenticity in Eclipse Theia

  In Eclipse Theia versions 0.3.9 through 0.15.0, one of the default pre-packaged Theia extensions is "Mini-Browser", published as "@theia/mini-browser" on npmjs.com. This extension, for its own needs, exposes a HTTP endpoint that allows to read the content of …

  The Eclipse Foundation Eclipse Theia @theia/mini-browser npm
  Mar 10, 2020