Skip to content
OpenAdvisories

Product · The Eclipse Foundation

Eclipse Theia

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.8
    CVE-2021-34435

    Remote code execution in Eclipse Theia

    In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside the IDE. But with the way it is made it is possible for a previewed HTML file to trigger an RCE. This exploit only happens if a user previews…

    The Eclipse Foundation Eclipse Theia @theia/mini-browser npm
  • High 8.1
    CVE-2019-17636

    Insufficient Verification of Data Authenticity in Eclipse Theia

    In Eclipse Theia versions 0.3.9 through 0.15.0, one of the default pre-packaged Theia extensions is "Mini-Browser", published as "@theia/mini-browser" on npmjs.com. This extension, for its own needs, exposes a HTTP endpoint that allows to read the content of …

    The Eclipse Foundation Eclipse Theia @theia/mini-browser npm