GHSA-w6v7-w58j-pg5rMediumCVSS 6.1

Improper Verification of Communication Channel in @theia/plugin-ext

Published
November 15, 2021
Last Modified
February 1, 2023

🔗 CVE IDs covered (1)

CVE-2021-41038 →

📋 Description

In versions of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, Webview contents can be hijacked via postMessage().

🎯 Affected products1

  • npm/@theia/plugin-ext:< 1.18.0

🔗 References (4)