Skip to content
OpenAdvisories
Medium · 6.1 CVE-2021-28162 EUVD-2021-1039GHSA-c94v-8fff-73ph

Command Injection in @theia/messages

Published Mar 12, 2021 · Updated Aug 3, 2024 · Assigned by eclipse

Vendor: The Eclipse Foundation Product: Eclipse Theia Package: @theia/messages Ecosystem: npm

Description

In Eclipse Theia versions up to and including 0.16.0, in the notification messages there is no HTML escaping, so Javascript code can run.

Affected products

VendorProductAffectedFixed
The Eclipse Foundation Eclipse Theia unspecified – ≤ 0.16.0 —

Affected packages

EcosystemPackageAffectedFixedRecord
npm @theia/messages < 1.0.0 1.0.0 GHSA-c94v-8fff-73ph

References