← Database

CVE-2021-34436

CRITICAL CVSS: 9.8 Published: 2021-09-02 Modified: 2026-06-17

Description

In Eclipse Theia 0.1.1 to 0.2.0, it is possible to exploit the default build to obtain remote code execution (and XXE) via the theia-xml-extension. This extension uses lsp4xml (recently renamed to LemMinX) in order to provide language support for XML. This is installed by default.

Affected Platforms

Eclipse Theia

Weakness Type

CWE-22, CWE-611, CWE-22, CWE-611

References