Executive brief
Eclipse Theia is an open-source IDE framework that allows developers to write and debug code. The debug console component fails to properly escape HTML/JavaScript input, allowing arbitrary code injection. An attacker could craft a malicious debug output that executes JavaScript in a user's browser when the console displays it, potentially leading to credential theft or session hijacking.
Technical details
The vulnerability is a cross-site scripting (XSS) flaw in the debug console component (ansi-console-item.tsx) caused by improper use of dangerouslySetInnerHTML without HTML escaping. An attacker who can control debug output—such as through a malicious debugging session or crafted application output—can inject arbitrary JavaScript that executes in the context of the Theia IDE user's browser. The attack requires user interaction (viewing the injected output in the debug console) but no authentication. The vulnerability affects Theia up to and including version 1.8.0 and was fixed in version 1.8.1.
Affected products
- Eclipse Theia up to and including 1.8.0
Timeline
- 2020-11-28: disclosed: Issue reported on GitHub
- 2021-03-12: advisory: CVE-2021-28161 published on NVD
- 2021: patched: Fixed in version 1.8.1