Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2021-28161

In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be injected.

VectorNETWORK

PublishedMar 12, 2021, 22:15

Published Byemo@eclipse.org

Base Score

Score6.1

Package (Ecosystem)IntroducedFixedLimit

@theia/console(npm)01.8.1N/A

CWE-79

Base Score

6.1

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Base SeverityMedium

Version

3.1

Attack Vector (AV)

NETWORK