GitHub Advisoryadvisory · npm

GHSA-cwg9-c9cr-p5fq Improper Neutralization of Input in Theia console

MEDIUM Published 2021-04-13 Modified 2021-03-26 Official page ↗

Aliases: CVE-2021-28161
Ecosystem: npm
Packages: @theia/console
Severity: Moderate
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses: CWE-79
Reviewed: 2021-03-26

Affected packages

• npm @theia/console: < 1.8.1 → fixed in 1.8.1

Description

In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be injected.

Related

Alias · CVE (1)

CVE-2021-28161 In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be… vulnerability

Weakness · CWE (1)

CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References