GHSA-c94v-8fff-73ph

ghsaUSosv

Command Injection in @theia/messages

view advisory published 2021-05-10Licence: CC-BY-4.0

In Eclipse Theia versions up to and including 0.16.0, in the notification messages there is no HTML escaping, so Javascript code can run.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-28162US	medium6.1	0.78% (56th)	—	2021-03-12
In Eclipse Theia versions up to and including 0.16.0, in the notification messages there is no HTML escaping, so Javascript code can run.

External citations — patches, advisories, analysis.

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.