~ / search / GHSA-gcm9-cc3r-c6vj

GHSA-gcm9-cc3r-c6vj

Cross-site Scripting (XSS) in Eclipse Theia

Source: GitHub Advisory Database (reviewed) Critical CVE-2020-27224

Packages

EcosystemPackageAffectedFixed in
npm @theia/preview < 1.3.0 1.3.0

Details

As written in the advisory (Markdown source, shown as plain text).

In Eclipse Theia versions up to and including 1.2.0, the Markdown Preview (@theia/preview), can be exploited to execute arbitrary code.

References

External links from the advisory. They lead to third-party sites.