CVE-2021-28161 Improper Neutralization of Input in Theia console
Attackers can inject arbitrary JavaScript into the Eclipse Theia debug console due to missing HTML escaping, potentially executing code in the user's context.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-28161?
CVE-2021-28161 is a medium-severity cross-site scripting vulnerability in Eclipse Theia, published on 12 Mar 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be injected.
Weakness: CWE-79
Which versions are affected by CVE-2021-28161?
2 open source packages ship an affected version, including @theia/console. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@theia/console npm | All versions | 1.8.1 |
@theia/console npm | All versions | 1.8.1 |
Products include Eclipse Theia.
How do I fix CVE-2021-28161?
Upgrade @theia/console to 1.8.1 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2021-28161 being exploited?
There is no known exploitation of CVE-2021-28161 in the wild and no public exploit code.
Other vulnerabilities in Eclipse Theia
- CVE-2021-34436 XML external entity in Eclipse Theia
- CVE-2020-27224 Cross-site Scripting (XSS) in Eclipse Theia
- CVE-2026-60009 File upload in Eclipse Theia
- CVE-2021-34435 Remote code execution in Eclipse Theia
- CVE-2026-44688 [Eclipse Theia] Indirect Prompt Injection via Adversarial Workspace File and Directory Names in AI Chat
Sources
Also known as GHSA-cwg9-c9cr-p5fq.