Skip to content
OpenAdvisories
Critical · 9.6 CVE-2020-27224 EUVD-2021-0825GHSA-gcm9-cc3r-c6vj

Cross-site Scripting (XSS) in Eclipse Theia

Published Feb 24, 2021 · Updated Aug 4, 2024 · Assigned by eclipse

Vendor: The Eclipse Foundation Product: Eclipse Theia Package: @theia/preview Ecosystem: npm

Description

In Eclipse Theia versions up to and including 1.2.0, the Markdown Preview (@theia/preview), can be exploited to execute arbitrary code.

Affected products

VendorProductAffectedFixed
The Eclipse Foundation Eclipse Theia unspecified – ≤ 1.2.0 —

Affected packages

EcosystemPackageAffectedFixedRecord
npm @theia/preview < 1.3.0 1.3.0 GHSA-gcm9-cc3r-c6vj

References