CVE-2021-34435

HIGH

Eclipse Theia 0.3.9-1.8.1 - Remote Code Execution via Mini-Browser HTML Preview

Title source: llm
STIX 2.1

Description

In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside the IDE. But with the way it is made it is possible for a previewed HTML file to trigger an RCE. This exploit only happens if a user previews a malicious file..

References (1)

Core 1
Core References
Exploit, Patch, Vendor Advisory x_refsource_confirm
https://bugs.eclipse.org/bugs/show_bug.cgi?id=568018

Scores

CVSS v3 8.8
EPSS 0.0058
EPSS Percentile 42.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-942 CWE-346
Status published
Products (2)
eclipse/theia 0.3.9 - 1.8.1
theia/mini-browser 0.3.9 - 1.9.0npm
Published Sep 01, 2021
Tracked Since Feb 18, 2026