← All advisories

Critical severity9.6NVD Advisory· Published Feb 24, 2021· Updated Jun 17, 2026

CVE-2020-27224

CVE-2020-27224

Description

In Eclipse Theia versions up to and including 1.2.0, the Markdown Preview (@theia/preview), can be exploited to execute arbitrary code.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
@theia/previewnpm	< 1.3.0	1.3.0

Affected products

3

Eclipse/Theia
cpe:2.3:a:eclipse:theia:*:*:*:*:*:*:*:*
Range: <=1.2.0
ghsa-coords
pkg:npm/%40theia/preview
Range: < 1.3.0
Eclipse/Eclipse Theia.github.iocpe-rescue
Range: unspecified

Patches

Vulnerability mechanics

References

6

github.com/eclipse-theia/theia/issues/7954nvdExploitIssue TrackingThird Party AdvisoryWEB
omespino.com/write-up-google-bug-bounty-xss-to-cloud-shell-instance-takeover-rce-as-root-5000-usd/nvdExploitThird Party Advisory
github.com/advisories/GHSA-gcm9-cc3r-c6vjghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2020-27224ghsaADVISORY
github.com/eclipse-theia/theia/pull/7971ghsaWEB
omespino.com/write-up-google-bug-bounty-xss-to-cloud-shell-instance-takeover-rce-as-root-5000-usdghsaWEB

News mentions

0

No linked articles in our index yet.