Improper Verification of Communication Channel in @theia/plugin-ext

中危 6.1CVE-2021-41038 · GHSA-w6v7-w58j-pg5r · Published 10/11/2021 · updated 17/06/2026

要点

Package	Affected versions	Patched versions
theia eclipse	`< 1.18.0`	`1.18.0`
@theia/plugin-ext npm	`< 1.18.0`	`1.18.0`

In versions of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, Webview contents can be hijacked via postMessage().

NVD description

In versions of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, Webview contents can be hijacked via postMessage().

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

< 1.18.0

1.18.0

npm

< 1.18.0

1.18.0

theia 的其他漏洞

查看全部 →