In versions of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, Webview contents can be hijacked via postMessage().
The product establishes a communication channel to handle an incoming request that has been initiated by an actor, but it does not properly verify that the request is coming from the expected origin.
Link | Tags |
---|---|
https://bugs.eclipse.org/bugs/show_bug.cgi?id=575924 | issue tracking exploit third party advisory |
https://github.com/eclipse-theia/theia/pull/10125 | third party advisory patch |