CVE-2021-34436

CRITICAL

Eclipse Theia 0.1.1-0.2.0 - Remote Code Execution and XML External Entity Injection via theia-xml-extension

Title source: llm

Description

In Eclipse Theia 0.1.1 to 0.2.0, it is possible to exploit the default build to obtain remote code execution (and XXE) via the theia-xml-extension. This extension uses lsp4xml (recently renamed to LemMinX) in order to provide language support for XML. This is installed by default.

References (1)

Core 1

Core References

Vendor Advisory x_refsource_confirm

https://bugs.eclipse.org/bugs/show_bug.cgi?id=563174

Scores

CVSS v3 9.8

EPSS 0.0350

EPSS Percentile 87.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-22 CWE-611

Status published

Products (1)

eclipse/theia 0.1.1 - 0.2.0

Published Sep 02, 2021

Tracked Since Feb 18, 2026