Description (CNA)
In versions of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, Webview contents can be hijacked via postMessage().
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| The Eclipse Foundation / @theia/plugin-ext | affected unspecified before 1.18.0 |
CWE
CWE-940
References
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=575924
- https://github.com/eclipse-theia/theia/pull/10125
ADP enrichment
No English description supplied.