Description
In versions of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, Webview contents can be hijacked via postMessage().
Remediation
References
https://bugs.eclipse.org/bugs/show_bug.cgi?id=575924
https://github.com/eclipse-theia/theia/pull/10125
Related Vulnerabilities
CVE-2022-32065 Vulnerability in maven package com.ruoyi:ruoyi
CVE-2021-32702 Vulnerability in npm package nextjs-auth0
CVE-2021-32730 Vulnerability in maven package org.xwiki.platform:xwiki-platform-administration-ui
CVE-2020-28438 Vulnerability in npm package deferred-exec
CVE-2022-41250 Vulnerability in maven package com.meowlomo.jenkins:scm-httpclient