Description
In Eclipse Theia 0.3.9 to 1.8.1, the “mini-browser” extension allows a user to preview HTML files in an iframe inside the IDE. But with the way it is made it is possible for a previewed HTML file to trigger an RCE. This exploit only happens if a user previews a malicious file.
Recommendation
Update the @theia/mini-browser package to the latest compatible version. Followings are version details:
- Affected version(s): >= 0.3.9, < 1.9.0
- Patched version(s): 1.9.0
References
- GHSA-v9w2-v7j9-rjpr
- bugs.eclipse.org
- CVE-2021-34435
- CWE-346
- CWE-668
- CWE-942
- CAPEC-310
- OWASP 2021-A1
- OWASP 2021-A5
- OWASP 2021-A6
- OWASP 2021-A7
Related Issues
- pg-promise SQL Injection vulnerability - CVE-2025-29744
- njwt Prototype Pollution vulnerability - CVE-2024-34273
- Elliptic allows BER-encoded signatures - CVE-2024-42461
- ejs lacks certain pollution protection - CVE-2024-33883
- Tags:
- npm
- @theia/mini-browser
Anything's wrong? Let us know Last updated on January 29, 2023