Cross-site scripting in Eclipse Theia
Priority LOW 28CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be injected.
Why it matters now
EPSS 0.00708 53rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed @theia/console (npm): 1.8.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Eclipse Foundation | Eclipse Theia | up to 1.8.0 | — | No fix listed | CNA |
| — | @theia/console (npm) | before 1.8.1 | 1.8.1 | Patch available | GHSA-cwg9-c9cr-p5fq |
- Eclipse Theia VendorEclipse Foundation Affected up to 1.8.0 Fixed in — No fix listed CNA
- @theia/console (npm) Vendor— Affected before 1.8.1 Fixed in 1.8.1 Patch available GHSA-cwg9-c9cr-p5fq
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:eclipse:theia:*:*:*:*:*:*:*:* | up to 1.8.0 | Vulnerable | Eclipse Foundation |
- cpe:2.3:a:eclipse:theia:*:*:*:*:*:*:*:* Versions up to 1.8.0 Vulnerable ·Eclipse Foundation
Remediation
- Fix · GHSA-cwg9-c9cr-p5fq @theia/console (npm) Fixed in 1.8.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-28161
- 2026-10-03 Alias added: GHSA-cwg9-c9cr-p5fq
References
More Eclipse Foundation Theia vulnerabilities
- TI-2026-12294 Prototype pollution in Eclipse Theia CVSS 4.0MEDIUM 5.7
- TI-2021-13470 Path traversal in Eclipse Theia CVSS 3.1CRITICAL 9.8
- TI-2020-16550 Cross-site scripting in Eclipse Theia CVSS 3.1CRITICAL 9.6
- TI-2026-10807 Path traversal in Eclipse Theia CVSS 3.1HIGH 7.5
- TI-2026-44283 Information disclosure in Eclipse Theia CVSS 3.1HIGH 7.5
- TI-2026-42788 Path traversal in Eclipse Theia CVSS 3.1HIGH 8.8
Sources
- CVE-2021-28161 · CVE Program
- CVE-2021-28161 · NVD
- FIRST EPSS
- GHSA-cwg9-c9cr-p5fq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences