In Eclipse Theia versions up to and including 0.16.0, in the notification messages there…
Priority LOW 29CWE-830Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-829.
Summary
In Eclipse Theia versions up to and including 0.16.0, in the notification messages there is no HTML escaping, so Javascript code can run.
Why it matters now
EPSS 0.00776 56th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed @theia/messages (npm): 1.0.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Eclipse Foundation | Eclipse Theia | up to 0.16.0 | — | No fix listed | CNA |
| — | @theia/messages (npm) | before 1.0.0 | 1.0.0 | Patch available | GHSA-c94v-8fff-73ph |
- Eclipse Theia VendorEclipse Foundation Affected up to 0.16.0 Fixed in — No fix listed CNA
- @theia/messages (npm) Vendor— Affected before 1.0.0 Fixed in 1.0.0 Patch available GHSA-c94v-8fff-73ph
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:eclipse:theia:*:*:*:*:*:*:*:* | up to 0.16.0 | Vulnerable | Eclipse Foundation |
- cpe:2.3:a:eclipse:theia:*:*:*:*:*:*:*:* Versions up to 0.16.0 Vulnerable ·Eclipse Foundation
Remediation
- Fix · GHSA-c94v-8fff-73ph @theia/messages (npm) Fixed in 1.0.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-28162
- 2026-10-03 Alias added: GHSA-c94v-8fff-73ph
References
More Eclipse Foundation Theia vulnerabilities
- TI-2026-12294 Prototype pollution in Eclipse Theia CVSS 4.0MEDIUM 5.7
- TI-2021-13470 Path traversal in Eclipse Theia CVSS 3.1CRITICAL 9.8
- TI-2020-16550 Cross-site scripting in Eclipse Theia CVSS 3.1CRITICAL 9.6
- TI-2026-10807 Path traversal in Eclipse Theia CVSS 3.1HIGH 7.5
- TI-2026-44283 Information disclosure in Eclipse Theia CVSS 3.1HIGH 7.5
- TI-2026-42788 Path traversal in Eclipse Theia CVSS 3.1HIGH 8.8
Sources
- CVE-2021-28162 · CVE Program
- CVE-2021-28162 · NVD
- FIRST EPSS
- GHSA-c94v-8fff-73ph · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences