CVE-2021-41038

Description

In versions of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, Webview contents can be hijacked via postMessage().

Affected Platforms

Weakness Type

CWE-940, NVD-CWE-Other

References

• https://bugs.eclipse.org/bugs/show_bug.cgi?id=575924
• https://github.com/eclipse-theia/theia/pull/10125
• https://bugs.eclipse.org/bugs/show_bug.cgi?id=575924
• https://github.com/eclipse-theia/theia/pull/10125