CVE-2021-28161

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be injected.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
The Eclipse FoundationEclipse Theia>= unspecified, <= 1.8.0

References

Timeline

Published
Mar 12, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-281626.1In Eclipse Theia versions up to and including 0.16.0, in the notification messages there is no HTML escaping, so Javascript code can run.CVE-2021-281632.7In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink,CVE-2021-281645.3In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segmCVE-2021-281657.5In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invaCVE-2021-281666.5In Eclipse Mosquitto version 2.0.0 to 2.0.9, if an authenticated client that had connected with MQTT v5 sent a crafted CONNACK message to thCVE-2021-281676.5In Eclipse Openj9 to version 0.25.0, usage of the jdk.internal.reflect.ConstantPool API causes the JVM in some cases to pre-resolve certain CVE-2021-281685.5Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure vulnerability. This is due to the use CVE-2021-281695.3For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to aCVE-2021-281705.3In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be CVE-2021-281719.8The Vangene deltaFlow E-platform does not take properly protective measures. Attackers can obtain privileged permissions remotely by tamperiCVE-2021-281727.5There is a Path Traversal vulnerability in the file download function of Vangene deltaFlow E-platform. Remote attackers can access credentiaCVE-2021-281739.8The file upload function of Vangene deltaFlow E-platform does not perform access controlled properly. Remote attackers can upload and execut