GHSA-cwg9-c9cr-p5fq

Source

https://github.com/advisories/GHSA-cwg9-c9cr-p5fq

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/04/GHSA-cwg9-c9cr-p5fq/GHSA-cwg9-c9cr-p5fq.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-cwg9-c9cr-p5fq

Aliases

CVE-2021-28161

Published

2021-04-13T15:18:53Z

Modified

2023-11-08T04:05:28Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Improper Neutralization of Input in Theia console

Details

In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be injected.

Database specific

{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2021-03-26T23:20:56Z",
    "nvd_published_at":  "2021-03-12T22:15:00Z",
    "severity":  "MODERATE"
}

References

Affected packages

npm / @theia/console

Package

Name: @theia/console; View open source insights on deps.dev
Purl: pkg:npm/%40theia/console

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.8.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/04/GHSA-cwg9-c9cr-p5fq/GHSA-cwg9-c9cr-p5fq.json"