Executive brief
Eclipse Theia is an open-source cloud and desktop IDE framework. The notification messaging system fails to properly escape HTML, allowing attackers to inject arbitrary JavaScript code that executes in the application context. An attacker could exploit this to steal data, execute commands, or compromise systems running Theia.
Technical details
The vulnerability is a stored command injection in the @theia/messages package caused by improper HTML escaping in notification messages. The vulnerable code in notification-component.tsx uses dangerouslySetInnerHTML to render user-controlled message content without sanitization (line 76), allowing attackers to inject arbitrary JavaScript payloads such as <details open ontoggle=confirm(2)>. The attack vector requires user interaction (e.g., launching a debugger with a malicious configuration file), but can execute in both Electron and web contexts. The vulnerability was fixed in version 1.0.0 by implementing proper HTML escaping.
Affected products
- Eclipse @theia/messages up to and including 0.16.0
Timeline
- 2020-03-05: disclosed: Issue reported on GitHub
- 2021-03-12: advisory: CVE-2021-28162 published on NVD
- 2021-05-10: advisory: GHSA-c94v-8fff-73ph published
- 2021-03-26: patched: Fixed in version 1.0.0