QwikSec

Security Database

CVE

CWE

Training

CVE-2021-34435

Published: Sep 1, 2021

Modified: Aug 4, 2024

PUBLISHED

Description

In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside the IDE. But with the way it is made it is possible for a previewed HTML file to trigger an RCE. This exploit only happens if a user previews a malicious file..

Vendor	Product	Versions
The Eclipse Foundation	Eclipse Theia	affected `0.3.9 - < unspecified` affected `unspecified - <= 1.8.1`

Weaknesses (CWE)

References

https://bugs.eclipse.org/bugs/show_bug.cgi?id=568018

x_refsource_CONFIRM

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.