Improper Neutralization of Input in Theia console

Description

In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be injected.

Recommendation

Update the @theia/console package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.8.1
• Patched version(s): 1.8.1

References

• GHSA-cwg9-c9cr-p5fq
• CVE-2021-28161
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Command Injection in lodash (GHSA-35jh-r3h4-6jhm) - CVE-2021-23337
• Bootstrap Cross-Site Scripting (XSS) vulnerability - CVE-2024-6531
• Regular Expression Denial of Service in jsoneditor - CVE-2021-3822
• @intlify/shared Prototype Pollution vulnerability - CVE-2024-52810

Tags:

npm

@theia/console