Description
In versions of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, Webview contents can be hijacked via postMessage().
Remediation
References
https://bugs.eclipse.org/bugs/show_bug.cgi?id=575924
https://github.com/eclipse-theia/theia/pull/10125
Related Vulnerabilities
CVE-2023-44487 Vulnerability in maven package org.apache.tomcat.embed:tomcat-embed-core
CVE-2023-33962 Vulnerability in maven package io.jstach:jstachio
CVE-2021-41189 Vulnerability in maven package org.dspace:dspace-api
CVE-2022-2596 Vulnerability in npm package node-fetch
CVE-2019-1010091 Vulnerability in maven package org.webjars.npm:tinymce