Description
In versions of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, Webview contents can be hijacked via postMessage().
Remediation
References
https://bugs.eclipse.org/bugs/show_bug.cgi?id=575924
https://github.com/eclipse-theia/theia/pull/10125
Related Vulnerabilities
CVE-2022-0436 Vulnerability in maven package org.webjars.npm:grunt
CVE-2018-11693 Vulnerability in maven package org.webjars.npm:node-sass
CVE-2017-16167 Vulnerability in npm package yyooopack
CVE-2022-36527 Vulnerability in maven package com.jflyfox:jflyfox_jfinal
CVE-2021-39167 Vulnerability in npm package @openzeppelin/contracts