Description
In versions of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, Webview contents can be hijacked via postMessage().
Remediation
References
https://bugs.eclipse.org/bugs/show_bug.cgi?id=575924
https://github.com/eclipse-theia/theia/pull/10125
Related Vulnerabilities
CVE-2022-24818 Vulnerability in maven package org.geotools:gt-metadata
CVE-2021-23392 Vulnerability in npm package locutus
CVE-2022-31160 Vulnerability in maven package org.webjars:jquery-ui
CVE-2021-41571 Vulnerability in maven package org.apache.pulsar:pulsar
CVE-2022-36892 Vulnerability in maven package org.jenkins-ci.plugins:rhnpush-plugin