Cross-site Scripting (XSS) in Eclipse Theia

Description

References

• nvd.nist.gov/vuln/detail/CVE-2020-27224 · ADVISORY
• eclipse-theia/theia · WEB
• eclipse-theia/theia#7971 · WEB
• omespino.com/write-up-google-bug-bounty-xss-to-cloud-shell-instance-takeover-rce-as-root-5000-usd · WEB
• omespino.com/write-up-google-bug-bounty-xss-to-cloud-shell-instance-takeover-rce-as-root-5000-usd · Exploit

Weitere Schwachstellen in theia

• CVE-2026-61891HOCH 7.5In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes HTTP file-download endpoints (`GET /file`, `GE…
• CVE-2026-60009HOCH 8.8In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in every filesystem-enabled …
• CVE-2026-14574MITTEL 6.5In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the `PreferenceUtils.merge` function in `@theia/core` recursively merges pref…
• CVE-2026-12609HOCH 7.5In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend exposes the `/hostedPlugin/:pluginId/:path(*…
• CVE-2026-46580HOCH 8.8In Eclipse Theia versions prior to 1.71.0, files matching the pattern .prompts/*.prompttemplate in a workspace were automatically loaded and…