Description

In versions of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, Webview contents can be hijacked via postMessage().

Remediation

References

https://bugs.eclipse.org/bugs/show_bug.cgi?id=575924

https://github.com/eclipse-theia/theia/pull/10125

Related Vulnerabilities

CVE-2022-21129 Vulnerability in npm package nemo-appium

CVE-2018-19048 Vulnerability in maven package org.webjars:simditor

CVE-2020-7703 Vulnerability in npm package nis-utils

CVE-2021-43138 Vulnerability in npm package async

CVE-2023-40817 Vulnerability in maven package org.opencrx:opencrx-core-models

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Exploit Issue Tracking Third Party Advisory Patch NVD-CWE-Other