Cross-site Scripting (XSS) in Eclipse Theia

CRÍTICO 9.6CVE-2020-27224 · GHSA-gcm9-cc3r-c6vj · Published 24/02/2021 · updated 17/06/2026

En resumen

CVE-2020-27224 es una vulnerabilidad CRÍTICO (CVSS 9.6) que afecta a theia (eclipse), @theia/preview.
Probabilidad de explotación en los próximos 30 días (EPSS): 2.6%, mayor que el 85.3% de las vulnerabilidades.
Solución: actualizar a 1.3.0 o posterior.

Package	Affected versions	Patched versions
theia eclipse	`≤ 1.2.0`	No fix yet
@theia/preview npm	`< 1.3.0`	`1.3.0`

In Eclipse Theia versions up to and including 1.2.0, the Markdown Preview (@theia/preview), can be exploited to execute arbitrary code.

NVD description

In Eclipse Theia versions up to and including 1.2.0, the Markdown Preview (@theia/preview), can be exploited to execute arbitrary code.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

≤ 1.2.0

No fix yet

npm

< 1.3.0

1.3.0

Más vulnerabilidades de theia

Ver todo →