Description

In versions of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, Webview contents can be hijacked via postMessage().

Remediation

References

https://bugs.eclipse.org/bugs/show_bug.cgi?id=575924

https://github.com/eclipse-theia/theia/pull/10125

Related Vulnerabilities

CVE-2020-5219 Vulnerability in maven package org.webjars.npm:angular-expressions

CVE-2020-6454 Vulnerability in maven package org.webjars.npm:electron

CVE-2018-6464 Vulnerability in npm package simditor

CVE-2022-48285 Vulnerability in npm package jszip

CVE-2017-16107 Vulnerability in npm package pooledwebsocket

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Exploit Issue Tracking Third Party Advisory Patch NVD-CWE-Other