medium6.1
CVE-2021-28161
Improper Neutralization of Input in Theia console
Impact
In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be injected.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @theia/console | < 1.8.1 | 1.8.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Eclipse | Theia | through 1.8.0 |