Executive brief
Eclipse Theia is a web-based IDE and development environment framework. The Markdown Preview component contains a cross-site scripting (XSS) vulnerability that allows attackers to execute arbitrary code within the context of the Theia application, potentially compromising the development environment and any code or credentials accessible to it.
Technical details
This is a Stored/Reflected XSS vulnerability (CWE-79) in the Markdown Preview component (@theia/preview) of Eclipse Theia. The vulnerability allows arbitrary code execution through crafted markdown content. Attack vector is network-based with low complexity; user interaction is required (opening a malicious markdown preview). An attacker can achieve high impact across confidentiality, integrity, and availability by injecting malicious scripts that execute in the browser context of the Theia IDE. The vulnerability affects all versions up to and including 1.2.0, with a fix released in version 1.3.0.
Affected products
- Eclipse Theia up to and including 1.2.0
Timeline
- 2021-02-24: disclosed
- 2021-04-13: advisory
- 2021-04-13: patched: Fixed in version 1.3.0