← All advisories

Medium severity6.1NVD Advisory· Published Mar 12, 2021· Updated Jun 17, 2026

CVE-2021-28161

CVE-2021-28161

Description

In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be injected.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
@theia/consolenpm	< 1.8.1	1.8.1

Affected products

3

Eclipse/Theia
cpe:2.3:a:eclipse:theia:*:*:*:*:*:*:*:*
Range: <=1.8.0
ghsa-coords
pkg:npm/%40theia/console
Range: < 1.8.1
Eclipse/Eclipse Theia.github.iocpe-rescue
Range: unspecified

Patches

Vulnerability mechanics

References

3

github.com/eclipse-theia/theia/issues/8794nvdExploitIssue TrackingThird Party AdvisoryWEB
github.com/advisories/GHSA-cwg9-c9cr-p5fqghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2021-28161ghsaADVISORY

News mentions

0

No linked articles in our index yet.