CVE-2021-28162CWE-830

In Eclipse Theia versions up to and including 0.16.0, in the notification messages there is no HTML escaping, so Javascript code can run

published March 12, 2021

CVSS
—
EPSS
1%
Percentile
55.3
In the wild
Unconfirmed
What it is

In Eclipse Theia versions up to and including 0.16.0, in the notification messages there is no HTML escaping, so Javascript code can run.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00776 · 55.3th percentile
Weakness
CWE-830 · Inclusion of Web Functionality from an Untrusted Source
Published
2021-03-12T21:40Z
EPSS history
Timeline
  • 12 MAR 21:40Z
    In Eclipse Theia versions up to and including 0.16.0, in the notification messages there is no HTML escaping, so Javascript code can run
    cvelistv5