Description
In versions of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, Webview contents can be hijacked via postMessage().
Remediation
References
https://bugs.eclipse.org/bugs/show_bug.cgi?id=575924
https://github.com/eclipse-theia/theia/pull/10125
Related Vulnerabilities
CVE-2010-1870 Vulnerability in maven package com.opensymphony:xwork-core
CVE-2019-17495 Vulnerability in maven package org.webjars.bower:swagger-ui
CVE-2021-30246 Vulnerability in npm package jsrsasign
CVE-2022-25895 Vulnerability in npm package lite-dev-server
CVE-2023-24188 Vulnerability in maven package com.bstek.ureport:ureport2-core