Improper Verification of Communication Channel in @theia/plugin-ext

MEDIO 6.1CVE-2021-41038 · GHSA-w6v7-w58j-pg5r · Published 10/11/2021 · updated 17/06/2026

En resumen

CVE-2021-41038 es una vulnerabilidad MEDIO (CVSS 6.1) que afecta a theia (eclipse), @theia/plugin-ext.
Probabilidad de explotación en los próximos 30 días (EPSS): 0.74%, mayor que el 54.5% de las vulnerabilidades.
Solución: actualizar a 1.18.0 o posterior.

Package	Affected versions	Patched versions
theia eclipse	`< 1.18.0`	`1.18.0`
@theia/plugin-ext npm	`< 1.18.0`	`1.18.0`

In versions of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, Webview contents can be hijacked via postMessage().

NVD description

In versions of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, Webview contents can be hijacked via postMessage().

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

< 1.18.0

1.18.0

npm

< 1.18.0

1.18.0

Más vulnerabilidades de theia

Ver todo →