high8.8
CVE-2021-34435
Remote code execution in Eclipse Theia
Impact
In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside the IDE. But with the way it is made it is possible for a previewed HTML file to trigger an RCE. This exploit only happens if a user previews a malicious file.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @theia/mini-browser | >= 0.3.9, < 1.9.0 | 1.9.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Eclipse | Theia | from 0.3.9 through 1.8.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=568018
- https://github.com/advisories/GHSA-v9w2-v7j9-rjpr
- https://nvd.nist.gov/vuln/detail/CVE-2021-34435
- https://github.com/eclipse-theia/theia/pull/8759
- https://github.com/eclipse-theia/theia/commit/0761dcf5fe3c14c27432683d42d2c526ad0cfbd5