Skip to content

Product

theia @theia/mini-browser vulnerabilities

2 published CVES affecting theia @theia/mini-browser, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
2
Critical
0
High
2
Medium
0
Low
0
Unscored
0
CISA KEV
0

Latest theia @theia/mini-browser CVEs

Newest publication first

  1. CVE-2021-34435 Remote code execution in Eclipse Theia

    Published
    HighCVSS 8.8 EPSS 0.60%

    In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside the IDE. But with the way it is made it is possible for a previewed HTML file to trigger an RCE. This exploit only happens if a user previews a malicious file..

  2. CVE-2019-17636 Insufficient Verification of Data Authenticity in Eclipse Theia

    Published
    HighCVSS 8.1 EPSS 0.60%

    In Eclipse Theia versions 0.3.9 through 0.15.0, one of the default pre-packaged Theia extensions is "Mini-Browser", published as "@theia/mini-browser" on npmjs.com. This extension, for its own needs, exposes a HTTP endpoint that allows to read the content of files on the host's f...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.