Improper Neutralization of Input in Theia console

Description

In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be injected.

Recommendation

Update the @theia/console package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.8.1
• Patched version(s): 1.8.1

References

• GHSA-cwg9-c9cr-p5fq
• CVE-2021-28161
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Improper Input Validation in is-email - CVE-2021-36716
• Improper Verification of Communication Channel in @theia/plugin-ext - CVE-2021-41038
• Improper Input Validation in sanitize-html - CVE-2021-26539
• Improper Neutralization of Input During Web Page Generation in CKEditor4 - CVE-2020-27193

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@theia/console