Description
In versions of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, Webview contents can be hijacked via postMessage().
Remediation
References
https://bugs.eclipse.org/bugs/show_bug.cgi?id=575924
https://github.com/eclipse-theia/theia/pull/10125
Related Vulnerabilities
CVE-2022-3423 Vulnerability in npm package nocodb
CVE-2023-30331 Vulnerability in maven package com.ibeetl:beetl
CVE-2023-36478 Vulnerability in maven package org.eclipse.jetty.http3:http3-qpack
CVE-2020-15231 Vulnerability in maven package org.mapfish.print:print-servlet
CVE-2022-29219 Vulnerability in npm package @chainsafe/lodestar