Improper Verification of Communication Channel in @theia/plugin-ext

Description

In versions of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, Webview contents can be hijacked via postMessage().

Recommendation

Update the @theia/plugin-ext package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.18.0
• Patched version(s): 1.18.0

References

• GHSA-w6v7-w58j-pg5r
• bugs.eclipse.org
• CVE-2021-41038
• CWE-940
• CAPEC-310
• OWASP 2021-A6
• OWASP 2021-A7

Related Issues

• Finance.js vulnerable to DoS via the IRR function’s depth parameter - CVE-2025-56571
• Mermaid improperly sanitizes sequence diagram labels leading to XSS - CVE-2025-54881
• Payload does not invalidate JWTs after log out (GHSA-5v66-m237-hwf7) - CVE-2025-4643
• Vite's server.fs.deny bypassed with /. for files under project root - CVE-2025-46565

Tags:

npm

@theia/plugin-ext