Cross-site Scripting (XSS) in Eclipse Theia

Description

In Eclipse Theia versions up to and including 1.2.0, the Markdown Preview (@theia/preview), can be exploited to execute arbitrary code.

Recommendation

Update the @theia/preview package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.2.0
• Patched version(s): 1.3.0

References

• GHSA-gcm9-cc3r-c6vj
• omespino.com
• CVE-2020-27224
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Pandao Editor.md vulnerable to cross-site scripting (XSS) in iframe src parameter - CVE-2020-19697
• Pandao Editor.md vulnerable to cross-site scripting (XSS) in editor parameter - CVE-2020-19698
• CleverTap Web SDK is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage - CVE-2026-26862
• Cross-site Scripting (XSS) - Stored in crud-file-server - CVE-2018-3726

Tags:

npm

@theia/preview