Product · The Eclipse Foundation

Eclipse Theia

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

Medium 6.1

CVE-2021-28162

Command Injection in @theia/messages

In Eclipse Theia versions up to and including 0.16.0, in the notification messages there is no HTML escaping, so Javascript code can run.

The Eclipse Foundation Eclipse Theia @theia/messages npm

Mar 12, 2021
Medium 6.1

CVE-2021-28161

Improper Neutralization of Input in Theia console

In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be injected.

The Eclipse Foundation Eclipse Theia @theia/console npm

Mar 12, 2021