GHSA-cwg9-c9cr-p5fq

ghsaUSosv

Improper Neutralization of Input in Theia console

view advisory published 2021-04-13Licence: CC-BY-4.0

In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be injected.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-28161US	medium6.1	0.71% (53rd)	—	2021-03-12
In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be injected.

External citations — patches, advisories, analysis.

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.