Improper Verification of Communication Channel in @theia/plugin-ext

Description

In versions of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, Webview contents can be hijacked via postMessage().

Recommendation

Update the @theia/plugin-ext package to the latest compatible version. Followings are version details:

Affected version(s): < 1.18.0
Patched version(s): 1.18.0

References

GHSA-w6v7-w58j-pg5r
bugs.eclipse.org
CVE-2021-41038
CWE-940
CAPEC-310
OWASP 2021-A6
OWASP 2021-A7

Could your website be exposed too?

SmartScanner can check your website for Improper Verification of Communication Channel in @theia/plugin-ext and gives you actionable findings to investigate.

Start a free scan

Related Issues

Improper Neutralization of Input in Theia console - CVE-2021-28161
Improper Scope Validation in the `open` Endpoint of `tauri-plugin-shell` - CVE-2025-31477
Remote code execution in Eclipse Theia - CVE-2021-34435
Script injection - @backstage/plugin-techdocs - CVE-2021-32661

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

See something that needs correcting? Let us knowUpdated February 01, 2023