Description
In versions of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, Webview contents can be hijacked via postMessage().
Remediation
References
https://bugs.eclipse.org/bugs/show_bug.cgi?id=575924
https://github.com/eclipse-theia/theia/pull/10125
Related Vulnerabilities
CVE-2020-11988 Vulnerability in maven package org.apache.xmlgraphics:xmlgraphics-commons
CVE-2022-22965 Vulnerability in maven package org.springframework.boot:spring-boot-starter-web
CVE-2023-27480 Vulnerability in maven package org.xwiki.platform:xwiki-platform-xar-model
CVE-2022-25878 Vulnerability in npm package protobufjs
CVE-2023-45133 Vulnerability in maven package org.webjars.npm:babel-traverse