medium6.1
CVE-2021-28162
Command Injection in @theia/messages
Impact
In Eclipse Theia versions up to and including 0.16.0, in the notification messages there is no HTML escaping, so Javascript code can run.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @theia/messages | < 1.0.0 | 1.0.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Eclipse | Theia | through 0.16.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/eclipse-theia/theia/issues/7283
- https://github.com/advisories/GHSA-c94v-8fff-73ph
- https://nvd.nist.gov/vuln/detail/CVE-2021-28162
- https://github.com/eclipse-theia/theia/pull/7289
- https://github.com/eclipse-theia/theia/blob/master/CHANGELOG.md#v100---26032020