~ / search / GHSA-c94v-8fff-73ph

GHSA-c94v-8fff-73ph

Command Injection in @theia/messages

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-28162

Packages

EcosystemPackageAffectedFixed in
npm @theia/messages < 1.0.0 1.0.0

Details

As written in the advisory (Markdown source, shown as plain text).

In Eclipse Theia versions up to and including 0.16.0, in the notification messages there is no HTML escaping, so Javascript code can run.

References

External links from the advisory. They lead to third-party sites.