Описание
Command Injection in @theia/messages
In Eclipse Theia versions up to and including 0.16.0, in the notification messages there is no HTML escaping, so Javascript code can run.
Пакеты
Наименование
@theia/messages
npm
Затронутые версииВерсия исправления
< 1.0.0
1.0.0
Связанные уязвимости
CVSS3: 6.1
nvd
почти 5 лет назад
In Eclipse Theia versions up to and including 0.16.0, in the notification messages there is no HTML escaping, so Javascript code can run.