| Package | Affected versions | Patched versions |
|---|---|---|
| theia | ≥ 0.3.9, ≤ 1.8.1 | |
| @theia/mini-browser | ≥ 0.3.9, < 1.9.0 | 1.9.0 |
In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside the IDE. But with the way it is made it is possible for a previewed HTML file to trigger an RCE. This exploit only happens if a user previews a malicious file.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free