What is GHSA-gcm9-cc3r-c6vj?

GHSA-gcm9-cc3r-c6vj is a security advisory published by GitHub Security Advisories with Critical severity. Cross-site Scripting (XSS) in Eclipse Theia

Which CVE IDs does GHSA-gcm9-cc3r-c6vj cover?

GHSA-gcm9-cc3r-c6vj covers the following CVE IDs: CVE-2020-27224. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-gcm9-cc3r-c6vj?

GHSA-gcm9-cc3r-c6vj has a CVSS v3 base score of 9.6, published by GitHub Security Advisories.

Which products are affected by GHSA-gcm9-cc3r-c6vj?

GHSA-gcm9-cc3r-c6vj affects 1 product, including: npm/@theia/preview:\u003c 1.2.0.

GHSA-gcm9-cc3r-c6vjCriticalCVSS 9.6

Cross-site Scripting (XSS) in Eclipse Theia

Vendor

GitHub Security Advisories

Published

April 13, 2021

Last Modified

February 1, 2023

🔗 CVE IDs covered (1)

CVE-2020-27224 →

📋 Description

In Eclipse Theia versions up to and including 1.2.0, the Markdown Preview (@theia/preview), can be exploited to execute arbitrary code.

🎯 Affected products1

npm/@theia/preview:< 1.2.0

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2020-27224
https://github.com/eclipse-theia/theia/issues/7954
https://github.com/eclipse-theia/theia/pull/7971
https://omespino.com/write-up-google-bug-bounty-xss-to-cloud-shell-instance-takeover-rce-as-root-5000-usd/
https://github.com/advisories/GHSA-gcm9-cc3r-c6vj