| Package | Affected versions | Patched versions |
|---|---|---|
| theia | ≤ 0.16.0 | |
| @theia/messages | < 1.0.0 | 1.0.0 |
In Eclipse Theia versions up to and including 0.16.0, in the notification messages there is no HTML escaping, so Javascript code can run.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free