← All advisories

Medium severity6.1NVD Advisory· Published Nov 10, 2021· Updated Jun 17, 2026

CVE-2021-41038

CVE-2021-41038

Description

In versions of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, Webview contents can be hijacked via postMessage().

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
@theia/plugin-extnpm	< 1.18.0	1.18.0

Affected products

3

Eclipse/Theia
cpe:2.3:a:eclipse:theia:*:*:*:*:*:*:*:*
Range: <1.18.0
ghsa-coords
pkg:npm/%40theia/plugin-ext
Range: < 1.18.0
Eclipse/@theia/plugin-extcpe-rescue
Range: unspecified

Patches

Vulnerability mechanics

References

4

github.com/eclipse-theia/theia/pull/10125nvdPatchThird Party AdvisoryWEB
bugs.eclipse.org/bugs/show_bug.cginvdExploitIssue TrackingThird Party AdvisoryWEB
github.com/advisories/GHSA-w6v7-w58j-pg5rghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2021-41038ghsaADVISORY

News mentions

0

No linked articles in our index yet.