Product

theia @theia/plugin-ext vulnerabilities

1 published CVE affecting theia @theia/plugin-ext, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total: 1
Critical: 0
High: 0
Medium: 1
Low: 0
Unscored: 0
CISA KEV: 0

Latest theia @theia/plugin-ext CVEs

Newest publication first

CVE-2021-41038 Improper Verification of Communication Channel in @theia/plugin-ext
Published 2021-11-10

MediumCVSS 6.1 EPSS 0.74%

In versions of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, Webview contents can be hijacked via postMessage().

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.

theia @theia/plugin-ext vulnerabilities

Latest theia @theia/plugin-ext CVEs

CVE-2021-41038 Improper Verification of Communication Channel in @theia/plugin-ext