~ / search / GHSA-cwg9-c9cr-p5fq

GHSA-cwg9-c9cr-p5fq

Improper Neutralization of Input in Theia console

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-28161

Packages

EcosystemPackageAffectedFixed in
npm @theia/console < 1.8.1 1.8.1

Details

As written in the advisory (Markdown source, shown as plain text).

In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be injected.

References

External links from the advisory. They lead to third-party sites.